our enterprise security scanner reported a cross-site scripting vulnerability for the AjaxUploader.  What it was able to do was modify the UploadOK() handler script to include a textarea and more scripting:

 

<script type='text/javascript'>if(window.parent.CurrentUpload)window.parent.CurrentUpload.UploadOK('""'></SCRIPT></TITLE></TEXTAREA>'""></XSS/*-*/STYLE=xss:e/**/xpression(try{a=firstTime}catch(e){firstTime=1;alert(2431)})>','95c88ae3-3f1a-447e-af75-71f8c9c8cb46')</script>

 

Could you tell me how I could address this vulnerability?  I have Microsoft's AntiXss library, which includes a JavaScriptEncode() method which can be called on the server side, but I don't know how to access the script in question.

 

thanks,

 

Pete

Hi,

 

I don't think that is vulnerability while the URL is generated by uploader and the script code is generated from the same website.

 

Regards,
Terry

 

Unfortunately, our security folks regard it as a vulnerability and won't let me use the AJAXUploader unless the problem is addressed - is there a way for me to examine that script on the server side?  That would allow me to scan for objectionable characters and throw an exception, or at least strip them out.

 

thanks,

 

Pete

Pete,

 

OK.

 

We can verify the url and let the uploader can pass your XSS validation, on next upgrate, about two days later.

 

Regards,

Terry

 

thanks, Terry.  Will you send me an email to let me know, or do I need to check back here in 2 days?

 

regards,

 

Pete

Pete

 

We we update the control , I will reply this thread.

 

Regards,

Terrh

Hi,

 

Please download the control again.

 

Regards,

Terry

Terry,

 

the only AjaxUploader download I found was updated 02-03-2009 - is that it?  Seems like that date is before I pointed out the problem.

 

thanks,

 

Pete

 

Terry,

 

is there a way I can be notified via email when there's activity on this thread?  I tried toggling the "EnableSubscription" button, but I'm not getting any notifications.

 

thanks,

 

Pete

Pete,

 

Please download it again.

 

the assembly title should be 20090212

 

--

by the way I haven't used the email notify function of this forums yet. 

 

Regards,

Terry