[ISN] US Government Security Site Vulnerable to Common Attack

[InfoSec News]

http://news.netcraft.com/archives/2005/12/14/us_government_security_site_vulnerable_to_common_attack.html

By Rich Miller
December 14, 2005

The U.S. government site that tracks cyber security risks was recently
found vulnerable to cross-site scripting, a technique commonly used in
hacker attacks and web site spoofing. Several security sites have
published a demonstration of the security hole in the web site for the
National Institute of Standards and Technology (NIST), which hosts the
U.S. National Vulnerability Database, which ironically includes
numerous examples of cross-site scripting.

Cross-site scripting (XSS) is a well known technique which involves
injecting the text of code to be executed by the browser into urls
that generate dynamic pages. Attacks using XSS have been found by
security researchers in a wide variety of products and specific sites
in recent years. The cross-site scripting vulnerability in the NIST
site was found in a script that warns visitors that they are about to
leave the NIST site, a common practice on U.S. government sites. The
NIST script allows potentially malicious Javascript to be appended to
the URL and executed by the browser, a technique which works in
Firefox and Internet Explorer. The flaw was originally reported by the
RootShell Security Group. Staff at the NIST web site closed the
security hole after being contacted by people who saw the RootShell
posting.

The Netcraft Toolbar blocks common cross-site scripting attacks,
protecting users from coding weaknesses in trusted sites, including
the NIST flaw. "That was the first time when a trusted,
security-related site generated a Block XSS? message to me," noted
security researcher Juha-Matti Laurio, a frequent contributor to
security community resources on the web.

Web programmers can prevent most cross-site scripting attacks by
validating form input and potential modifications to URLs, and
ensuring that all user data is correctly encoded before it is
displayed or stored.