AWStats Patch for [ 2001151 ] XSS Issue

[sander2930]

FeG Wrote:Hi all,

I guess that the AWStats coming with ispCP is affected by the XSS vulnerabilty described here: http://sourceforge.net/tracker/index.php...tid=113764

If so, I'd suppose the following following patch, which is an adapted modification from this one: http://awstats.cvs.sourceforge.net/awsta...view=patch

Code:

--- awstats.pl    2006-11-04 22:17:24.000000000 +0100
+++ awstats.pl    2008-08-19 13:28:14.000000000 +0200
@@ -4394,6 +4394,7 @@
sub DecodeEncodedString {
    my $stringtodecode=shift;
    $stringtodecode =~ tr/\+/ /s;
+    $stringtodecode =~ s/%22//g;
    $stringtodecode =~ s/%([A-F0-9][A-F0-9])/pack("C", hex($1))/ieg;
    return $stringtodecode;
}
@@ -4437,8 +4438,12 @@
#------------------------------------------------------------------------------
sub CleanFromCSSA {
    my $stringtoclean=shift;
+    # To avoid html tags and javascript
    $stringtoclean =~ s/</&lt;/g;
    $stringtoclean =~ s/>/&gt;/g;
+    $stringtoclean =~ s/|//g;
+    # To avoid onload="
+    $stringtoclean =~ s/onload//g;
    return $stringtoclean;
}

You can apply this patch by writing the given text into /usr/lib/cgi-bin/awstats.patch and then executing:

Code:

$ cd /usr/lib/cgi-bin/
$ patch -p0 < awstats.patch
$ rm awstats.patch

Greetings
FeG

PS: On my ispCP / AWStats installation I could not get the POC running, but I'm not sure that it doesn't because Firefox does some blocks on XSS.

/usr/lib/cgi-bin# patch -p0 < aw.patch
patching file awstats.pl
patch: **** malformed patch at line 4: sub DecodeEncodedString {

---

debian etch
awstats 6.5+dfsg-1