Received the following error messages from a vulnerability scan on the site:
3) Severe: XSS (GET) (No Auth) [fires in IE, not FF],/, [name of an arbitrarily supplied request parameter]:
http://www.example.com/?9e0ac">
9694dc44c7b=1
Note: All further XSS findings similarly relate to www.example.com also. Actions: i) Reject arbitrary parameters, ii) apply output-encoding to usersupplied data.
4) Severe: XSS (GET) (No Auth) [fires in IE, not FF],/about ,[name of an arbitrarily supplied request parameter]:
http://www.example.com/about?59561">
442acacfbc9=1
5) Severe: XSS (GET) (No Auth) [fires in IE, not FF],/archive/spotlight ,[name of an arbitrarily supplied request parameter]:
http://www.example.com/archive/spotlight?24bce">
354caf28516=1
6) Severe: XSS (GET) (No Auth) [fires in IE, not FF],/articles ,[name of an arbitrarily supplied request parameter]:
http://www.example.com/articles?f80e0">
2df0e7c35b3=1
7) Severe: XSS (GET) (No Auth) [fires in IE, not FF], /blogfront ,[name of an arbitrarily supplied request parameter]:
http://www.example.com/blogfront?846ee">
937a1e5c305=1
and received many more of these for various pages on the site.
Is there a rewrite rule that can be applied to .htaccess to stop this?
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
or should the generic rewite rules handle this?
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !=/favicon.ico
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
Comments
update...
After further research I added the below rewrite rules in htaccess for the IE issue of XSS (above the standard Drupal rewite rules):
RewriteCond %{HTTP_USER_AGENT} !^.*Chrome.* [NC]
RewriteCond %{HTTP_USER_AGENT} !^.*Firefox.* [NC]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC]
RewriteRule ^(.*)$ index.php [F,L]
Basically if the browser is not Firefox and Chrome (most of our traffic are those two browsers) it will check to see if script tags are in the URL and return the 403 Forbidden page. Also, note that IE 8/9 will detect XSS by default for protection and will display a warning that IE has changed the page to prevent cross site scripting.