1234325 - Backport upstream bug 1230932 to bmo/4.2 to fix providing a condition as an ID to the webservice results in a taint error

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: API, defect)

Description

[David Lawrence [:dkl]]

+++ This bug was initially created as a clone of Bug #1230932 +++

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36

Steps to reproduce:

Hello,

My name is Netanel Rubin, I work as a vulnerability researcher at PerimeterX.

This is a critical vulnerability report for an issue I discovered in the Bugzilla platform. The successful exploitation of the vulnerability allows an attacker to successfully exploit an SQL Injection flaw assuming Taint Mode is disabled at the vulnerable script.

As a PoC, I've tested the vulnerability on your installation. It appears you have disabled Taint on jsonrpc.cgi (and possibly other pages), as the attack succeeded and I've managed to execute any SQL statement I wanted under a SELECT query.

I'm attaching the complete vulnerability report to this bug, as I learned from past experience this is your preferred method of communication.
Please assign a CVE number for this issue. We would also like to coordinate the public disclosure with you.

Best regards,
Netanel.

Comment 1

[Frédéric Buclin]

Cloning bugs really shouldn't copy the CC list, IMO.

Comment 2

[Dylan Hardison [:dylan] (he/him)]

(In reply to Frédéric Buclin from comment #1)
> Cloning bugs really shouldn't copy the CC list, IMO.

I do agree.

Comment 3

[David Lawrence [:dkl]]

Attachment: 1234325_1.patch

Can you review your work for me? :)

Comment 4

[David Lawrence [:dkl]]

(In reply to Frédéric Buclin from comment #1)
> Cloning bugs really shouldn't copy the CC list, IMO.

Yeah thanks for that. Normally I clear the cc list on cloned bugs and let the defaults get added. Forgot to do that this time.
I also agree than cloning should not automatically copy the full cc list.

dkl

Comment 5

[Dylan Hardison [:dylan] (he/him)]

Comment on attachment 8700743 [details] [diff] [review]
1234325_1.patch

Review of attachment 8700743 [details] [diff] [review]:
-----------------------------------------------------------------

missing validation for update_comment_tags

Comment 6

[David Lawrence [:dkl]]

Attachment: 1234325_2.patch

Comment 7

[Dylan Hardison [:dylan] (he/him)]

Comment on attachment 8700757 [details] [diff] [review]
1234325_2.patch

Review of attachment 8700757 [details] [diff] [review]:
-----------------------------------------------------------------

r=dylan

Comment 8

[David Lawrence [:dkl]]

To ssh://[e-mail]/webtools/bmo/bugzilla.git
   4049782..1e7b400  master -> master