CVE-2008-0980
Multiple XSS vulnerabilities in Spyce 2.1.3
- CVSS 4.3
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Configuration Issues
- Remote
Multiple cross-site scripting (XSS) vulnerabilities in Spyce – Python Server Pages (PSP) 2.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the url or type parameter to docs/examples/redirect.spy; (2) the x parameter to docs/examples/handlervalidate.spy; (3) the name parameter to spyce/examples/request.spy; (4) the Name parameter to spyce/examples/getpost.spy; (5) the mytextarea parameter, the mypass parameter, or an empty parameter to spyce/examples/formtag.spy; (6) the newline parameter to the default URI under demos/chat/; (7) the text1 parameter to docs/examples/formintro.spy; or (8) the mytext or mydate parameter to docs/examples/formtag.spy.
- CVSS base score
- 4.3
- Published
- 2008-02-25
- OWASP
- A03 Injection
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Configuration Issues
- Subcategory
- Cross-Site Scripting (XSS)
- Accessibility scope
- Remote
- Impact
- Arbitrary Code Execution
- Fixed by upgrading
- Yes
Solution
Update Spyce – Python Server Pages (PSP) to version 2.1.4 or higher.
Vulnerable code sample
def render_page_with_query_param(param_name):
if param_name == "url":
query_value = get_query_parameter("url")
elif param_name == "x":
query_value = get_query_parameter("x")
elif param_name == "name":
query_value = get_query_parameter("name")
elif param_name == "Name":
query_value = get_query_parameter("Name")
elif param_name == "mytextarea":
query_value = get_query_parameter("mytextarea")
elif param_name == "mypass":
query_value = get_query_parameter("mypass")
elif param_name == "newline":
query_value = get_query_parameter("newline")
elif param_name == "text1":
query_value = get_query_parameter("text1")
elif param_name == "mytext":
query_value = get_query_parameter("mytext")
elif param_name == "mydate":
query_value = get_query_parameter("mydate")
else:
query_value = ""
html_output = f"<h1>The parameter value is: {query_value}</h1>"
return html_output
def get_query_parameter(param_name):
query_params = {
"url": "test",
"x": "test",
"name": "test",
"Name": "test",
"mytextarea": "test",
"mypass": "test",
"newline": "test",
"text1": "test",
"mytext": "test",
"mydate": "test"
}
return query_params.get(param_name, "")Patched code sample
import html
def render_page_with_query_param(param_name):
allowed_params = {
"url", "x", "name", "Name", "mytextarea", "mypass",
"newline", "text1", "mytext", "mydate"
}
if param_name in allowed_params:
query_value = get_query_parameter(param_name)
else:
query_value = ""
escaped_value = html.escape(query_value)
html_output = f"<h1>The parameter value is: {escaped_value}</h1>"
return html_output
def get_query_parameter(param_name):
query_params = {
"url": "test",
"x": "test",
"name": "test",
"Name": "test",
"mytextarea": "test",
"mypass": "test",
"newline": "test",
"text1": "test",
"mytext": "test",
"mydate": "test"
}
return query_params.get(param_name, "")Cite this entry
@misc{vaitp:cve20080980,
title = {{Multiple XSS vulnerabilities in Spyce 2.1.3}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2008},
note = {VAITP Python Vulnerability Dataset, entry CVE-2008-0980},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2008-0980/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::