SECURITY: Reflected XSS attack about usu

[aimeos]

@ser Example: https://www.phpbb-seo.ir/community/?a=%27%22--%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Ealert(/OPENBUGBOUNTY/)%3C/scRipt%3E

[zetrader]

How to fix that? Is it really dangerous for the forum?

EDIT : I tried your url in my forum, changing https://exmaple.org/ with the url of my forum using USU, it made a 503 error :
"Service Unavailable
The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later."

Does it mean the reflected XSS attack worked or it failed?

[aimeos]

It's not critical like a SQL injection but attackers can take over any user account with this attack.
You must change the URL to a page with a login box and if it succeeds, you will get a JS alert box in your browser.

[ser]

How to do it? can you show some real example?

[zetrader]

I've read about it, the user need to click on the special url with all those things added (script etc.) which means he would be some kind of ignorant to click on this strange url, but ok, i guess it could happen of course, not everyone would wonder why so much parameters added in that url.
I've seen also that there would be some kind of protection with firefox or chrome against this kind of attack :
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
"The HTTP X-XSS-Protection response header is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks."

Also they talk about adding some lines in htaccess or with some php code.
"Block pages from loading when they detect reflected XSS attacks:
PHP
header("X-XSS-Protection: 1; mode=block");

Apache (.htaccess)

<IfModule mod_headers.c>
  Header set X-XSS-Protection "1; mode=block"
</IfModule>"

So adding this PHP code or adding those lines to htaccess would provide a protection against a reflected xss attack?

[zetrader]

@aimeos If i click on your link, it works, i have the alert box, but if take your link, change the url to my phpBB test forum url with USU, it doesn't work, it makes a 503 error : "Service Unavailable
The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later."
And trying with any of my domains, with another CMS (PluXml, PunBB), the same thing, same error using the same structure of url in your link.
So maybe my hosting has some kind of protection that phpbb seo doesn't have, because i can not make work the reflected xss attack using this type of url in any of my domains or directory.

[ser]

it looks pretty serious indeed :(

noscript has blocked it an once but not everyone has noscript installed....

@zetrader i'm really curious how you have 503 as my very carefully crafted server is vulnerable and I have the mentioned header on

[zetrader]

@ser @aimeos
Could you give a test too? My forums boards are actually in testing mode before choosing one, so i would like to know.
First, phpBB with mysql and usu :
http://aribaut.com/wiwi31/?a=%27%22--%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Ealert(/OPENBUGBOUNTY/)%3C/scRipt%3E
forum is here http://aribaut.com/wiwi31/

Second, phpBB with sqlite and seourls ( https://github.com/tas2580/seourls ) :
http://zetrader.fr/fofo/?a=%27%22--%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Ealert(/OPENBUGBOUNTY/)%3C/scRipt%3E
forum is here http://zetrader.fr/fofo/

Third, PunBB with mysql :
http://zeforums.com/?a=%27%22--%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Ealert(/OPENBUGBOUNTY/)%3C/scRipt%3E
forum is here http://zeforums.com/

Fourth, Pluxml (no database cms) :
http://zetrader.info/?a=%27%22--%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Ealert(/OPENBUGBOUNTY/)%3C/scRipt%3E
Blog is here http://zetrader.info/

http://zetrader.fr/?a=%27%22--%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Ealert(/OPENBUGBOUNTY/)%3C/scRipt%3E
Blog is here http://zetrader.fr/

http://aribaut.com/?a=%27%22--%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Ealert(/OPENBUGBOUNTY/)%3C/scRipt%3E
Blog is here http://aribaut.com/

All of this links give me a 503 error "Service Unavailable
The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.".

Is that the case for you?

After you tested, it could be interesting to test phpBB without the extension USU or SEO URLS.

[aimeos]

@meis2m Thanks a lot. When do you release a new version?

[ser]

@aimeos just clone the current master repo and you have new version :)