diff --git a/20260111204228-rss_articles.org b/20260111204228-rss_articles.org new file mode 100755 index 0000000..b714dfe --- /dev/null +++ b/20260111204228-rss_articles.org @@ -0,0 +1,7 @@ +* [[https://world.hey.com/dhh/a-petabyte-worth-of-omarchy-in-a-month-a1fc538e][A petabyte worth of Omarchy in a month]] + :PROPERTIES: + :FEED: David Heinemeier Hansson + :MINIFLUX_ID: 6150 + :READ_AT: 2026-05-28 18:01 + :END: + diff --git a/20260421100223-dailies.org b/20260421100223-dailies.org index e460475..ebe5e77 100755 --- a/20260421100223-dailies.org +++ b/20260421100223-dailies.org @@ -18,3 +18,8 @@ All daily journal entries, linked automatically. ** [[file:daily/2026-05-06.org][2026-05-06]] ** [[file:daily/2026-05-12.org][2026-05-12]] ** [[file:daily/2026-05-13.org][2026-05-13]] +** [[file:daily/2026-05-20.org][2026-05-20]] +** [[file:daily/2026-05-21.org][2026-05-21]] +** [[file:daily/2026-05-22.org][2026-05-22]] +** [[file:daily/2026-05-28.org][2026-05-28]] +** [[file:daily/2026-05-29.org][2026-05-29]] diff --git a/20260527152602-microlise_xss_rom_pentest.org b/20260527152602-microlise_xss_rom_pentest.org new file mode 100755 index 0000000..10a4bb1 --- /dev/null +++ b/20260527152602-microlise_xss_rom_pentest.org @@ -0,0 +1,438 @@ +:PROPERTIES: +:ID: b2ac09aa-e888-48d3-8357-2292f9b2526c +:END: +#+title: XSS Pentesting Report Fix +#+filetags: :microlise:security:notes: + +* Metadata + +- Name :: Understanding Session XSS +- Overview :: Pages 33–34 document an informational “Session stored XSS” finding on the TMC Schedule Execution Board. The issue is real (unescaped user input in a JavaScript context) but impact is limited because only the submitting user’s session is affected—classic self-XSS, not cross-user attack. + +** Todos + +- [X] review-finding :: Read pages 33–34 and map finding to SaveSearchCriteriaToSession + ScheduleExecutionBoard.aspx flow +- [X] locate-source :: Open TMC Web Portal repo and find session save + inline script render for date/orderID/time +- [ ] remediate-encode :: Apply HttpUtility.JavaScriptStringEncode to all session values in SetupControls() (~1849-1879) +- [ ] remediate-validate :: Add server-side validation in SaveSearchCriteriaToSession before writing SEBSessionState +- [ ] remediate-retest :: Retest with direct POST payload + normal UI search flow on ScheduleExecutionBoard + +* Understanding the Session Stored XSS Finding (Pages 33–34) + +** Where this sits in the report + +The [[file:d:/_dev/_misc/Pentest-04-26/Microlise TMC PO WA April 2026 v1.0.pdf][Microlise TMC PO WA April 2026 v1.0.pdf]] lists *14 findings* total. Pages 33–34 ([[file:d:/_dev/_misc/Pentest-04-26/33-34.pdf][33-34.pdf]]) are the last technical finding before “END OF DOCUMENT”: + +| Field | Value | +|-------------+-----------------------------------------------------------------------| +| Title | *Session stored XSS* | +| Severity | *Informational* (lowest tier; 4 informational findings in the report) | +| Status | Open | +| CWE | [[https://cwe.mitre.org/data/definitions/79.html][CWE-79]] — Improper Neutralization of Input | +| Environment | =cert.microlise.com= (cert/UAT), path prefix =/PENTEST/TMCWebPortal/= | + +Higher-severity items in the same report (SQLi, IDOR, BFLA, etc.) are separate; this finding is documented as *technically valid but low business risk*. + +----- + +** What XSS is (general) + +*Cross-Site Scripting (XSS)* means untrusted data ends up in a web page in a way the *browser treats as executable JavaScript*, instead of inert text. + +#+begin_src mermaid :exports none +sequenceDiagram + participant Attacker + participant App as WebApplication + participant Victim as VictimBrowser + + Attacker->>App: Submit malicious input + App->>App: Store or reflect input + App->>Victim: HTML/JS page containing payload + Victim->>Victim: Browser runs attacker's script + Note over Victim: Script runs with the site's origin
can access cookies, DOM, APIs +#+end_src + +The name “cross-site” is historical: classic attacks trick a *victim* into loading a page on *your* app so script runs in *your* origin (stealing session cookies, performing actions as the user, etc.). + +Common types: + +| Type | Persistence | Typical delivery | +|-------------+---------------------------------------+----------------------------------| +| *Reflected* | Not stored; one-off response | Malicious link/query param | +| *Stored* | Saved server-side (DB, file, session) | Victim loads a normal page later | +| *DOM-based* | Client-side only | Unsafe innerHTML, eval, etc. | + +*Defense in depth:* validate input on the server (whitelist formats), and *encode output* for the exact context (HTML, attribute, JavaScript string, URL). + +----- + +** What happened in /this/ finding (TMC context) + +*** Affected surface (source located) + +| Role | Path | +|-----------------------------+--------------------------------| +| Page + inline JS | [[file:d:/_dev/WebPortal/src/code/AmberWebUI/SEB/ScheduleExecutionBoard.aspx][ScheduleExecutionBoard.aspx]] | +| WebMethod + page properties | [[file:d:/_dev/WebPortal/src/code/AmberWebUI/SEB/ScheduleExecutionBoard.aspx.cs][ScheduleExecutionBoard.aspx.cs]] | +| Session storage | [[file:d:/_dev/WebPortal/src/code/AmberWebUI/SEB/SEBSessionState.cs][SEBSessionState.cs]] | + +- *Endpoint:* ASP.NET =[WebMethod]= =SaveSearchCriteriaToSession= on =ScheduleExecutionBoard.aspx= +- *Parameters:* JSON fields =date=, =orderID=, =time= (also =searchID=, =hours=, =quickSearch= in the same flow) +- *Host (pentest):* =cert.microlise.com=, path =/PENTEST/TMCWebPortal/SEB/...= + +*** Attack flow (as tested) + +#+begin_src mermaid +flowchart LR + subgraph submit [Step1_Submit] + A[Tester sends POST directly] + B[SaveSearchCriteriaToSession] + C[Values stored in server session] + end + subgraph render [Step2_Render] + D[User loads ScheduleExecutionBoard.aspx] + E[Server embeds session values in script block] + F[Browser executes unescaped JS] + end + A --> B --> C + C --> D --> E --> F +#+end_src + +1. *Save:* User (or tester) POSTs JSON to =SaveSearchCriteriaToSession=. The app saves search criteria into the *server-side session*. +2. *Render:* On the next load of =ScheduleExecutionBoard.aspx=, those values are written into the HTML *inside a =