Indico input parameter sanitizing

Administrators
1

Hello,

We are using Indico v2.2.8.
Vulnerability scan tool reports us as follows:

  • URL: /login/ may be vulnerable to HTML injection.
  • The ‘next’ parameter of the /login/ CGI :
    -------- input --------
    /login/?next=<<<<"“hdlbqh%20>>>
    -------- output --------
    Content-Type: text/html; charset=utf-8
    Content-Length: 5709
    X-Indico-URL: /login/?next=<<<<”"hdlbqh%20>>>
    …
  • URL: /event/###/event.ics may be vulnerable to HTML injection.
  • The ‘detail’ parameter of the /event/###/event.ics CGI :
    -------- input --------
    /event/###/event.ics?detail=<<<<"“hdlbqh%20>>>
    -------- output --------
    Content-Disposition: inline; filename=event.ics
    Cache-Control: no-cache, private
    X-Indico-URL: /event/###/event.ics?detail=<<<<”"hdlbqh%20>>>
    …

The tool says:

The remote web server is hosting a CGI script, but it is unable to properly sanitize a request string with malicious JavaScript.
An attacker could exploit this issue to execute arbitrary HTML in the user’s browser within the security context of the affected site.
Remote web servers can be vulnerable to IFRAME injection or cross-site scripting attacks.

Is Indico vulnerable ?
If so, how can we fix it ?

2

Not a vulnerability. This header always echoes back the current URL.