From 931352f92aaeca9e06e9a7b01939a5bcb0c84185 Mon Sep 17 00:00:00 2001 From: fyodor Date: Sat, 2 Jun 2012 21:24:15 +0000 Subject: [PATCH] Add a note to improve escaping in submit.cgi --- todo/nmap.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/todo/nmap.txt b/todo/nmap.txt index 1e86b4583..1cc2cf197 100644 --- a/todo/nmap.txt +++ b/todo/nmap.txt @@ -7,6 +7,11 @@ o Zenmap hang on OS X 10.7 o We should add fields to the service submitter (http://insecure.org/cgi-bin/submit.cgi?new-service) for the application name and version. + o We also need to ensure all fields of /cgi-bin/submit.cgi have + proper escapting to prevent possible reflected XSS attacks + reported by Maxim Rupp (@mmrupp). The risk is low, if any, since + we don't give authentication cookies for bad guys to steal, but is + still better to properly escape. o Migrate web.insecure.org to a RHEL-6 derived distro (probably CENTOS 6, since Linode doesn't currently offer ScientificLinux images).