TorrentFlux User-Agent XSS Vulnerability

[mnb93]

http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/

Name: TorrentFlux User-Agent XSS Vulnerability
Published: 2006-10-06
Critical Level: Moderate
Type: Cross-Site Scripting
Where: Remote
Status: 0-Day
Software: Torrentflux 2.1
Discoverer: Steven Roddis (http://www.stevenroddis.com.au)

I gave the authors of this product a week (more than usual) just to contact me, they have failed to do so; so I am releasing this vulnerability publicly!

/admin.php

Line: 325

$ip_info = $ip_resolved.”
“.$user_agent;

Useragent is not esacped.

Solution:

Edit source code:

/admin.php

Line: 325:

$ip_info = htmlentities($ip_resolved, ENT_QUOTES)."
".htmlentities($user_agent, ENT_QUOTES);

[Qrome]

There was no contact to me the author.

[mnb93]

I used this form: http://www.torrentflux.com/contact.php

[mnb93]

Line: 325:

$ip_info = htmlentities($ip_resolved, ENT_QUOTES)."
".htmlentities($user_agent, ENT_QUOTES);

[mnb93]

Are you going to fix it?
If you need help, please contact me.

[IhatemyISP]

It will be taken care of.

[Qrome]

The real fix for this is to edit the following in the settingsfunctions.php:

Line 33:

Code:

    return htmlentities(trim($_REQUEST[$varName]), ENT_QUOTES);

Lines 51-59:

Code:

    $rec = array(
                    'user_id' => $cfg['user'],
                    'file' => $file,
                    'action' => $action,
                    'ip' => htmlentities($cfg['ip'], ENT_QUOTES),
                    'ip_resolved' => htmlentities($host_resolved, ENT_QUOTES),
                    'user_agent' => htmlentities($_SERVER['HTTP_USER_AGENT'], ENT_QUOTES),
                    'time' => $create_time
                );

By doing this, all the request/get vars will be scrubed as well as any logging of user-agents and IP addresses reported by the visitor.

We are planning a TF 2.1.1 release very soon.

[Qrome]

TorrentFlux 2.2 is available for testing with the Supporting Members:

http://www.torrentflux.com/forum/index.php/topic,2082.0.html

We hope to have it released this week.