How to remediate – Xitami testssi.ssi HTTP Header XSS

1. Introduction

The Xitami testssi.ssi HTTP Header XSS vulnerability is a cross-site scripting flaw found in a testing script included with Xitami web servers. This allows an attacker to inject malicious scripts into a webpage viewed by other users, potentially stealing authentication credentials. Systems running the affected Xitami server software are at risk. A successful exploit could compromise confidentiality of user accounts.

2. Technical Explanation

The vulnerability exists because the ‘/testssi.ssi’ script does not properly sanitise input from the Host or User-Agent HTTP headers. An attacker can send a crafted request with malicious JavaScript code in these headers, which is then executed by the server and delivered to users’ browsers. The script is intended for testing server-side includes but lacks sufficient security controls.

• Root cause: Insufficient input validation of HTTP Host and User-Agent headers within the ‘/testssi.ssi’ script.
• Exploit mechanism: An attacker sends a request to the Xitami server with a malicious payload in the Host or User-Agent header, causing the script to output unsanitized JavaScript code that is executed by the user’s browser. For example, an attacker could set the User-Agent header to .
• Scope: Xitami web servers with the ‘/testssi.ssi’ script present.

3. Detection and Assessment

You can confirm vulnerability by checking for the presence of the test script, then attempting to trigger the XSS flaw.

• Quick checks: Check if the file ‘/testssi.ssi’ exists on the server using a web browser or command line tool like curl.
• Scanning: Nessus and OpenVAS may identify this vulnerability with plugin IDs depending on version. These are examples only.
• Logs and evidence: Examine web server logs for requests to ‘/testssi.ssi’ containing unusual characters in the Host or User-Agent headers.

curl -I http://your_xitami_server/testssi.ssi

4. Solution / Remediation Steps

The recommended solution is to remove the test script from the server. This eliminates the vulnerability entirely.

4.1 Preparation

• The primary dependency is access to the server’s filesystem. Roll back involves restoring the backup if removal causes unexpected issues.
• Change windows are usually low-risk for this change and should not require extensive approval.

4.2 Implementation

1. Step 1: Delete the ‘/testssi.ssi’ file from the Xitami server’s filesystem. Use a command like rm /testssi.ssi or equivalent for your operating system.

4.3 Config or Code Example

Before

/testssi.ssi file exists in web root directory

After

/testssi.ssi file does not exist in web root directory

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of issue. Least privilege limits the impact if exploited, and input validation prevents unsafe data from being processed.

• Practice 1: Implement least privilege principles for all server accounts and processes.
• Practice 2: Enforce strict input validation on all user-supplied data, including HTTP headers.

4.5 Automation (Optional)

# Example Bash script to remove the file
#!/bin/bash
if [ -f /testssi.ssi ]; then
  rm /testssi.ssi
  echo "Removed /testssi.ssi"
else
  echo "/testssi.ssi does not exist."
fi

5. Verification / Validation

Confirm the fix by checking that the file is removed and attempting to trigger the XSS vulnerability again.

• Post-fix check: Run ls -l /testssi.ssi. The expected output should be “No such file or directory”.
• Re-test: Attempt to access ‘/testssi.ssi’ in a web browser. It should return a 404 error.
• Smoke test: Verify that other website functionality continues to work as expected.
• Monitoring: Monitor web server logs for any unexpected errors related to missing files or scripts.

ls -l /testssi.ssi

6. Preventive Measures and Monitoring

Update security baselines to prevent the inclusion of unnecessary test scripts in production environments. Implement CI/CD pipeline checks for known vulnerabilities.

• Baselines: Update your server hardening baseline or CIS control configuration to disallow the presence of testing files like ‘/testssi.ssi’ in production.
• Asset and patch process: Review server configurations regularly for unnecessary or outdated components.

7. Risks, Side Effects, and Roll Back

Removing the file should not cause any service impacts as it is a test script. However, always back up your configuration first.

• Risk or side effect 1: No known risks are associated with removing this file.
• Roll back: Restore the backup of your Xitami server configuration if unexpected issues occur.

8. References and Resources

• Vendor advisory or bulletin: http://www.oliverkarow.de/research/xitami25c1_testssi_XSS.txt
• NVD or CVE entry: No specific NVD entry exists for this vulnerability as it is a test script issue.