[R2] Sophos Web Protection Appliance ftp_redirect.php s Parameter Reflected XSS

While investigating and authoring a plugin for a recently disclosed open redirect weakness (NSWA-989) in Sophos Web Application that was recently patched in version 4.3.0, Tenable discovered that the same script and parameter could be used for a reflected cross-site scripting attack. The offending code can be found in ftp_redirect.php.

The disclosed open redirect is exercised by controlling the $_GET[‘s’] used to create $myself. $myself is then assigned to window.location.href which will trigger the redirect. However, the $_GET[‘s’] can also be used to trigger a reflected XSS. Unfortunately, PHP on the Sophos Web Application server is configured to escape all quotes in $_GET[‘s’]. In theory, this limits the JavaScript that we can use to carry out such an XSS attack. For example, alert(“<3”); becomes alert(\”<3\”); and would fail to execute. In reality, escaping quotes via PHP is a waste of time and it can be bypassed without much effort. We crafted a PoC that will pop up the ASCII heart for Sophos when reporting it. <3