TYPO3 6.2.19 / 7.6.4 RemoveXSS.php Filter Bypass

`Madison Gurkha Security Advisory  
  
Advisory: TYPO3 circumvent RemoveXSS.php cross site scripting using BASE64 encoding  
  
1. DETAILS  
----------  
Product: Typo3 CMS  
Vendor URL: typo3.org  
Type: Cross-site Scripting[CWE-79]  
Date found: 2016-03-09  
Date published: 2016-05-19  
  
2. AFFECTED VERSIONS  
--------------------  
Typo3 6.2.19 and below  
Typo3 7.6.4 and below  
and other older versions may be affected too.  
Until the removal of the RemoveXSS.php function, versions will be affected.  
  
3. VULNERABILITY DETAILS  
------------------------  
The filter (RemoveXSS.php) to prevent XSS attacks when using the TYPO3   
framework can be circumvented.  
The filter is based on a blacklist method which specifies the actions  
that are not allowed. It is not recommended to implement security based  
on blacklisting methods. Proper input validation and output escaping (in  
the proper context) should be a sufficient measure against XSS attacks.  
  
According to the filter it is allowed to add special characters like  
"/><. These characters make it possible to create a reflected XSS attack  
in a HTML5 type response.  
  
Inserting the following BASE64 encoded string results in a reflected XSS  
vulnerability:  
  
"/><a  
href="data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ+">Click!</a>  
  
This vulnerability is discovered while testing the LTS versions 7.6.4  
and 6.2.19.  
  
Note that only applications that use this function will be affected.  
  
4. SECURITY RISK  
----------------  
An attacker is able to prepare a URL which, when requested by the victim,   
causes JavaScript under control of the attacker to be executed in the context   
of the browser of the victim. For example an attacker can steal (session) cookies   
or attack the browser and its components.  
  
5. SOLUTION  
-----------  
Do not use the RemoveXSS.php functionality.  
Instead of creating a blacklist use whitelisting to prevent XSS.  
Also whenever user input is included in (X)HTML documents,  
meta-characters need to be escaped (depending on the context).  
  
In HTML elements, this means that the characters <, >, and & need to be  
escaped, by replacing them by the strings <, > and & respectively.   
In values of attributes, depending on the type of quotes used,   
the character ’ or " needs to be replaced by &#x27; (in XHTML ' may be used)   
or " respectively.   
There is no harm in always escaping both.  
  
In JavaScript string literals the characters ’ or " (depending on the  
type of quotes used) need to be replaced by respectively \’ or \".   
There is no harm in always escaping both.   
Also, the characters \, line feed, carriage return, line separator and   
paragraph separator need to be replaced by respectively \\, \n, \r, \u2028 and \u2029.  
  
Validate user input, making sure that only suitable characters are  
accepted based on whitelisting.  
  
6. REPORT TIMELINE  
------------------  
2016-04-19: Vulnerability discovered  
2016-04-21: Vendor notified  
2016-04-26: Vendor acknowledges the vulnerability  
2016-05-18: Vendor permission for disclosure   
  
  
7. REFERENCES / CREDITS  
-----------------------   
This vulnerability was discovered and researched by Mandy van Oosterhout from  
Madison Gurkha.  
  
  
Madison Gurkha  
--------------  
Madison Gurkha supports organizations with high quality services to efficiently identify,   
mitigate and prevent IT security risks.  
For more information visit http://madison-gurkha.com/.  
`