Re: [WEB SECURITY] MOSS security

["Prasad Shenoy" <prasad.shenoy@xxxxxxxxx>]

Very nice Chris. After reading your blog, I am going to revisit some
of the deployments tomorrow but just a quick question while I am at
it. When you talk about XSS in Document Libraries, do you mean a
contributer can inject a script in the name/description of a document?
Or something else? Where can I get more information on this particular
topic?

Thanks.

Prasad

On Thu, May 22, 2008 at 8:00 PM, Chris Weber (Casaba Security)
<chris@xxxxxxxxxxxxxxxxxx> wrote:
> David, MOSS has builtin CSRF protections via the
> SPUtility.ValidateFormDigest() method inherited from its master page.
> There's also builtin XSS protections on ListItem's, but not the document
> library - watch out there.  You should also look for the use of
> SPSecurity.RunWithElevatedPermissions() when you start building apps on top
> of MOSS.  I wrote a bit about these and point to some other references here:
>
> http://lookout.net/2008/04/22/sharepoint-wss-and-moss-application-developmen
> t-and-security-testing/
>
> thanks,
> Chris
>
>
>
>
>
>
> -----Original Message-----
> From: David Felio [mailto:david@xxxxxxx]
> Sent: Wednesday, May 21, 2008 6:56 AM
> To: WASC Forum
> Subject: [WEB SECURITY] MOSS security
>
> After years in the LAMP stack, our company is going towards various MS
> products, including MOSS 2007/WSS 3.0. In various conversations with
> MS folks about security considerations, they always go back to
> permissions. I have not been terribly successful in getting them to
> discuss security beyond/outside setting permissions w/in MOSS correctly.
>
> Does anyone have experience for MOSS (or any SharePoint products) and
> have some ideas about security concerns? One of the things I am
> concerned about is CSRF, since the bulk of the administration is
> handled via a web interface, but there doesn't seem to be much
> existing research out there right now.
>
> Thanks.
>
> David
>
>
> ----------------------------------------------------------------------------
> Join us on IRC: irc.freenode.net #webappsec
>
> Have a question? Search The Web Security Mailing List Archives:
> http://www.webappsec.org/lists/websecurity/
>
> Subscribe via RSS:
> http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
>
> Join WASC on LinkedIn
> http://www.linkedin.com/e/gis/83336/4B20E4374DBA
>
>
>
> ----------------------------------------------------------------------------
> Join us on IRC: irc.freenode.net #webappsec
>
> Have a question? Search The Web Security Mailing List Archives:
> http://www.webappsec.org/lists/websecurity/
>
> Subscribe via RSS:
> http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
>
> Join WASC on LinkedIn
> http://www.linkedin.com/e/gis/83336/4B20E4374DBA
>
>



-- 
Ah! the beauty of hacking....

----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA