Enabling Global Script Protection is not working while adding "&"

Question

Hi All,
To prevent crosssite scripting attacks I ticked the the check box "Enable Global Script Protection" in CF admin. But it is not working , I mean not able to prevent the scripting attacks.
Steps I followed
1] I executed the below URL.
     https://xyz.abc.com/index.cfm?cardholder_number=&<script>alert(1)</script>
2] In the fornt end I got a javascript alert message as injected in the URL.
But this alert message should not come as I have enabled script protection in CF admin. Right????
Now I removed "&" (https://xyz.abc.com/index.cfm?cardholder_number=<script>alert(1)</script>) from the above URL  then I was not getting the javascript alert message. Does this mean that script protection will not work if we are adding "&" to the URL????.
I searched the neo-security.xml and its looks like below.
<var name='CrossSiteScriptPatterns'><struct type='coldfusion.server.ConfigMap'><var name='&lt;\s*(object|embed|script|applet|meta)'><string>&lt;InvalidTag</string></var></st ruct></var>
Can any one help me out to fix this.

Answer 1

Abdul L Koyappayil wrote:
But still one doubt remains why alert message is coming only when there is "&" in the URL??
This happens with "&" because it is a special Javascript symbol whose purpose is to delimit - that is, separate - the key-value value pairs in the URL's query-string. For example, in the URL www.myDomain.com/index.cfm?a=1&b=2, the "&" delimits the query-string into the 2 key-value pairs
a=1
b=2
Let us then consider the case where the URL is www.myDomain.com/index.cfm?cardholder_number=&<script>alert(1)</script>. The & will delimit the query-string into
cardholder_number=
<script>alert(1)</script>
The presence of '&' implies there are 2 variables. However, there is only one '=' sign, which means there is just one key-value pair. In addition, cardholder_number is a legal name for a URL variable, whereas <script>alert(1)</script> is not. The browser therefore sends the following query-string to your application
cardholder_number=EMPTY_STRING&<script>alert(1)</script>
However, Coldfusion's scriptprotect feature will intervene and neutralize this to
cardholder_number=EMPTY_STRING&<invalidtag>alert(1)</script>
which is harmless. These will enter into Coldfusion as the URL variables
cardholder_number=EMPTY_STRING
EMPTY_STRING=EMPTY_STRING
The special nature of '&' as delimiter is what prompts the browser to run the script. In fact, by default, browsers will run any Javascript that you place in the query-string. Run this, for example
http://www.myDomain.com/index.cfm?<script>alert(1)</script>
But what reason will I say if they are asking me why javascript alert is coming then.
As you have just seen, the <script> tag cannot come in. The alert occurs at the browser - that is, at the client - but Coldfusion runs at the server. Communication between client and server is by means of the URL variables that the client sends to the server. For the attack to be effective, it has to be sent in the form
sneakyVar=<script>alert(1)</script>
That is not the case here.