Identifying XSS Attack Vulnerabilities

Question

I experience a relentless XSS attack that I cannot prevent. I have three general input forms on my site - one for uploading images, one for adding comments to the page, and one for email via php. I protect them all anyway, but for some reason the vulnerability still exists.

My comment code:

for($j = 0; $j < 3 ; $j++) { $s = $styles[array_rand($styles)]; if($song_arr[$k] != '' && $artist_arr[$k] != '' && $name_arr[$k] != '') { echo '<td>'; echo '<div class="'.$s.'" style="clear:left" >'; echo '<p class="rendom">'; echo 'Song:&nbsp;'.htmlspecialchars($song_arr[$k]).'<br>Artist:&nbsp;'.htmlspecialchars($artist_arr[$k]).'<br>Submitted By:&nbsp;'.htmlspecialchars($name_arr[$k]); echo '</p>'; echo '</div>'; echo '</td>'; } $k++; } 

Download form:

  if ((($_FILES["userfile"]["type"] == "image/jpg") || ($_FILES["userfile"]["type"] == "image/jpeg") || ($_FILES["userfile"]["type"] == "image/pjpeg")) && ($_FILES["userfile"]["size"] < 20000)) { if (is_uploaded_file($_FILES['userfile']['tmp_name'])) { if (move_uploaded_file ($_FILES['userfile']['tmp_name'],'userfile.jpg')) { $image = new SimpleImage(); $image->load('userfile.jpg'); $image->resize(29,136); $image->save('userfile.jpg'); ?> <img src="img/text/uploadSuccess.jpg" alt="Image uploaded successfully." /><br /> <br /> <img src="userfile.jpg?rand=<? echo rand(1,10000); ?>" /> <? } else { echo 'Moving uploaded file failed'; } } else { echo 'File upload failed'; } } else { echo 'Invalid Filetype'; } 

Email Form:

 <?php // Process input variables (trim, stripslash, reformat, generally prepare for email) $recipients = trim($_POST['recipients']); $sender_email = trim($_POST['sender_email']); $sender_name = stripslashes(trim($_POST['sender_name'])); $subject = stripslashes(str_replace(array("\r\n", "\n", "\r"), " ", trim($_POST['subject']))); $message = stripslashes(str_replace(array("\r\n", "\n", "\r"), "<br />", trim($_POST['message']))); // Check email addresses for validity // Explode the comma-separated list of recipients + the sender email address into an array. Even if there is only one recipient, this will check for validity. $addresses = explode("," , $recipients.",".$sender_email); // For each email address specified... foreach ($addresses as $address) { // If the email address doesn't match the RFC8622 spec regex, assume invalid if (!(preg_match("~^[A-Z0-9._%+-] +@ (?:[A-Z0-9-]+\.)+(?:[AZ]{2}|com|org|net|uk|edu|jp|de|br|ca|gov|au|info|nl|fr|us|ru|it|cn|ch|tw|es|se|be|dk|pl|at|il|tv|nz|biz)$~i", trim($address)))) { // Output error message for invalid email address and end script. echo '"' . $address . '" is not a valid email address. Please try again.'; return; } } // Check other vars are not empty if ((empty($sender_name)) OR (empty($subject)) OR (empty($message))) { // Output error message and end script. echo 'Please complete all form fields and try again.'; return; } // Send HTML email $headers = "MIME-Version: 1.0\r\nContent-type:text/html;charset=iso-8859-1\r\nFrom: ". $sender_name ." <". $sender_email ."> \n\n"; if (mail($recipients,$subject,$message,$headers)) { // Mail successfully sent, output success message and end script echo 'Message sent. We will be in touch with you shortly.'; return; } else { // Something unknown went wrong. =( echo 'Something went wrong which the little worker monkeys could not fix. Please try again.'; return; } ?> 

XSS continues to appear in the absolute bottom of my index page, in which I include () all three of the above files, the contents of which are in different files.

Any ideas?

Answer 1

In the email form, you echo the return of invalid email addresses that were sent without leaving them. Change this line:

  echo '"' . $address . '" is not a valid email address. Please try again.'; 

to

  echo '"' . htmlspecialchars($address) . '" is not a valid email address. Please try again.'; 

Answer 2

After a quick look, it seems that the only place you show unreliable data is in the comments. And you used htmlspecialchars, which would prevent the interpretation of any HTML code.

You say that the malicious code is at the bottom of your page. Maybe the attacker found a way to download and include his script directive on your server? What does the inclusion code look like? Is this JavaScript, HTML?

Answer 3

This is not an answer, not good news, but I saw something very similar to what you described in the example in a rather disturbing video ad from Symantec, "Zeus: King of the Crimeware Toolkits" on Youtube: http://www.youtube. com / watch? v = hfjPO8_pGIk

In any case, it’s worth watching the video.

I have no connection with Symantec.