Advisory Title: CGI.pm vulnerable to Cross-site
Release Date: July 19 2003
Application: CGI.pm - which is by default included
in many common Perl distributions.
Platform: Most platforms. Tested on Apache and IIS.
Severity: Effects scripts which make use of start_form()
first informed on 30th April 2003
Fixed on 09 June 2003.
This perl 5 library uses objects to create Web fill-out
forms on the fly and to parse their contents. It provides a simple
interface for parsing and interpreting query strings passed to CGI
scripts. However, it also offers a rich set of functions for creating
fill-out forms. Instead of remembering the syntax for HTML form
elements, you just make a series of perl function calls. An important
fringe benefit of this is that the value of the previous query is
used to initialize the form, so that the state of the form is preserved
from invocation to invocation. .
CGI.pm has the ability to create forms by making
use of the start_form() function. The developer/perl scripter can
also makes use of start_multipart_form() which relies on start_form()
and is therefore vulnerable to the same issue. When the action for
the form is not specified, it is given the value of $self->url(-absolute=>1,-path=>1)
- which means that when the url is something like the following
.. the form becomes <form action="http://host/script.pl">some
text<!-- " >
In such case, it is possible to exploit this issue
to launch a Cross Site Scripting attack.
# example of exploitable script
$q = new CGI;
print $q->start_html('CGI.pm XSS');
Make sure you download the latest version:
The information within this document may change
without notice. Use of
this information constitutes acceptance for use in an AS IS
condition. There are NO warranties with regard to this information.
In no event shall the author be liable for any consequences whatsoever
arising out of or in connection with the use or spread of this
information. Any use of this information lays within the user's
Please send suggestions, updates, and comments to:
Eye on Security
mail : firstname.lastname@example.org
web : http://www.eyeonsecurity.org