CVE-2015-10010: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in OpenDNS OpenResolve. It has been rated as problematic. Affected by this issue is the function get of the file resolverapi/endpoints.py of the component API. The manipulation leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The name of the patch is c680170d5583cd9342fe1af43001fe8b2b8004dd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217196.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-02T21:15Z
Repository: https://github.com/opendns/OpenResolve
Language: Python
Files changed: resolverapi/endpoints.py
Commit date: 2015-08-03 16:27:18 -0700
Commit message: Prevent Reflected XSS

The API takes user input and validates them before making DNS calls but
if invalid, a response containing the user input is reflected back to
the user as it is without any sanitization. This makes OpenResolve
vulnerable to a reflected XSS attack.

Diff: diff --git a/resolverapi/endpoints.py b/resolverapi/endpoints.py
index aa80958..e8b4b0c 100644
--- a/resolverapi/endpoints.py
+++ b/resolverapi/endpoints.py
@@ -48,13 +48,13 @@ class LookupRecordType(Resource):
 
         return parse_query(answer, nameserver, duration)
 
     def valid_args(self, rdtype, domain):
         if not is_valid_rdtype(rdtype):
-            abort(400, message="%s type is not supported" % rdtype)
+            abort(400, message="The provided record type is not supported")
         if not is_valid_hostname(domain):
-            abort(400, message="%s is not a valid domain name" % domain)
+            abort(400, message="The provided domain name is invalid")
 
 
 class ReverseLookup(Resource):
 
     def get(self, ip):
@@ -77,11 +77,11 @@ class ReverseLookup(Resource):
                 if nameserver is nameservers[-1]:
                     current_app.logger.info(e)
                     return {'message': 'All nameservers timed out.'}, 503
                 continue
             except NXDOMAIN:
-                return {'message': 'No nameserver found for %s' % ip}, 404
+                return {'message': 'No nameserver found for the provided IP'}, 404
             except Exception as e:
                 current_app.logger.error(e)
                 return {'message': 'An unexpected error occured.'}, 500
 
         t2 = time.time()
@@ -91,6 +91,6 @@ class ReverseLookup(Resource):
             return {'message': 'An unexpected error occured.'}, 500
         return parse_query(answer, nameserver, duration)
 
     def valid_args(self, ip):
         if not is_valid_ip(ip):
-            abort(400, message="%s is not a valid ip address" % ip)
+            abort(400, message="The provided ip address is invalid")

Vulnerable code:             abort(400, message="%s type is not supported" % rdtype)
            abort(400, message="%s is not a valid domain name" % domain)
                return {'message': 'No nameserver found for %s' % ip}, 404
            abort(400, message="%s is not a valid ip address" % ip)
Fixed code:             abort(400, message="The provided record type is not supported")
            abort(400, message="The provided domain name is invalid")
                return {'message': 'No nameserver found for the provided IP'}, 404
            abort(400, message="The provided ip address is invalid")