Classic ASP -- Protect Against HTTP Header Injection

Question

I'm trying to protect a Classic ASP web application from HTTP Header Injected XSS attacks and am having trouble finding a solution that stops scripts found in the User Agent String.

Here is an example HTTP request to the web application:

HTTP Request
GET /WebApp/Login.aspx HTTP/1.1
Host: WebServer.Webapp.Com
User‐Agent: Mozilla/5.0 (X11; Linux x86_64; rv:41.0) Gecko/20100101 Firefox/41.0**alert(1)**
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept‐Language: en‐US,en;q=0.5
Accept‐Encoding: gzip, deflate
Cookie: ASP.NET_SessionId=foobarID
Connection: keep‐alive

Basically what we're trying to do is keep that alert script in the User Agent String from firing off when the page is loaded. I've been doing a lot of research and haven't been able to find too much help for this old app. We do have validateRequest and EnableHeaderChecking set to true, But this script still executes. Any help is really appreciated.

Is this an IIS problem or is the problem happening because you are displaying the User-Agent? — the_lotus
I don't think it's an IIS problem since XSS sent through an input field to the server is caught by request validation. I am spoofing the User Agent string to include some JavaScript and I'd like to know how to keep that script from running. — Sage
Actually, you may have just solved the problem... We have a hidden field I believe that stores the user agent field... Let me try to kill that and see what happens. — Sage
If that's the case, I would suggest you encode it before sending it to the page. — the_lotus
Yeah... I feel like an idiot right now... Haha... Thanks for the help. If you reply in an answer, I'll mark it as correct. — Sage

Sage Sage · Accepted Answer · 2015-10-20T16:38:15

The issue was from the user agent string (with the malicious script) being rendered on the page at the bottom for debug purposes. If you're having this issue, please check that you aren't displaying the object with the bad script on the page.

If you are, than remember to use HTML Encoding to render it safely.

Thanks to the_lotus and Lankymart for the quick answers.

Classic ASP -- Protect Against HTTP Header Injection

1 Answers