CiviCRM Community Forums (archive)

We just failed PCI compliance scan, and one of the errors was about the reset parameter being vulnerable to HTML injection. We're running Drupal 7.18 and CiviCRM 4.1.3. Full message below.  I'm going to dispute this, I just need to know the best way to do so?

GET HTTP method, SecurityMetrics found that : + The following resources may be
vulnerable to HTML injection : + The 'reset' parameter of the
/civicrm/contribute/transact CGI : /civicrm/contribute/transact?
reset=<minnew%0A> -------- output -------- Last-Modified: Sat, 22 Dec 2012
01:54:47 +0000 Cache-Control: no-cache, must-revalidate, post-check=0, precheck=0 Location: https://www.DOMAIN.org/civicrm/contribute/transact?res
et=<minnew%0A> X-Powered-By: PleskLin CF-RAY: 249adc4d1400291 ----------------
-------- + The 'id' parameter of the /civicrm/contribute/transact CGI :
/civicrm/contribute/transact?id=<minnew%0A> -------- output -------- Last-Modified:
Sat, 22 Dec 2012 01:54:49 +0000 Cache-Control: no-cache, must-revalidate, postcheck=0, pre-check=0 Location:
https://www.DOMAIN.org/civicrm/contribute/transact?id= <minnew%0A> XPowered-By: PleskLin CF-RAY: 249add471400291 ------------------------ + The 'reset'
parameter of the /civicrm/contribute/transact CGI : /civicrm/contribute/transact?
reset=<minnew%0A>&id=2 -------- output -------- Last-Modified: Sat, 22 Dec 2012
01:54:53 +0000 Cache- Control: no-cache, must-revalidate, post-check=0, precheck=0 Location: https://www.DOMAIN.org/civicrm/contribute/transact?res
et=<minnew%0A>&id=2 X-Powered-By: PleskLin CF-RAY: 249ade8e1400291 ---------
--------------- + The 'id' parameter of the /civicrm/contribute/transact CGI :
/civicrm/contribute/transact?reset=1&id=<minnew%0A> -------- output -------- LastModified: Sat, 22 Dec 2012 01:54:55 +0000 Cache- Control: no-cache, mustrevalidate, post-check=0, pre-check=0 Location:
https://www.DOMAIN.org/civicrm/contribute/transact?res
et=1&id=<minnew%0A> X-Powered-By: PleskLin CF-RAY: 249adfae1400291 ---------
--------------- Clicking directly on these URLs should exhibit the issue : (you will
probably need to read the HTML source)
http://www.DOMAIN.org/civicrm/contribute/transact?reset =<minnew%0A>
http://www.DOMAIN.org/civicrm/contribute/tran sact?id=<minnew%0A>
Other references : CWE:80, CWE:86 Resolution: Either restrict access to the
vulnerable application or contact the vendor for an update. Risk Factor: Medium/
CVSS2 Base Score: 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

if there is anything we can / should do to fix this and make it easier for folks going forward we should do it

In this case, i just checked and seems like we just do a simple redirect of the url as is to the https equivalent

lobo

jim:

can u take a look and see if u can come up with a patch for this. the relevant redirect code is at:

CRM/Utils/System.php, function redirectToSSL

lobo