434550 - XSS vulnerability in SUMO error page

Status: VERIFIED FIXED

(support.mozilla.org :: General, defect, P1)

Description

[Brandon Sterne (:bsterne)]

One of the tiki error pages uses the the URL parameter "error" as its display message.  This can be used for XSS or simply website defacement.  Here is an example attack URL:

http://support.mozilla.com/tiki-error.php?error=<a+href="javascript:alert(document.cookie)">Click+Me</a>

Comment 1

[Nelson Ko [:nkoth]]

Attachment: is this filtering enough?

Comment 2

[Brandon Sterne (:bsterne)]

A couple of comments on the attached patch:

1) you probably don't need to re-assign $_REQUEST["error"] as its escaped self since you are later displaying it using the same escaping functions.

2) a better approach for this type of page would be to have a set of pre-determined error messages that can be chosen from by specifying an error ID in the URL.  This is better than echoing a string that an attacker can easily modify.

The patch as attached will fix the present issue, though.  Just my 0.02.

Comment 3

[Laura Thomson :laura]

Comment on attachment 321667 [details] [diff] [review]
is this filtering enough?

Looks good to me.  Please commit ASAP.

Comment 4

[Nelson Ko [:nkoth]]

in r13337

Comment 5

[Laura Thomson :laura]

This was pushed in https://bugzilla.mozilla.org/show_bug.cgi?id=434670

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

http://support.mozilla.com/tiki-error.php?error=<a+href="javascript:alert(document.cookie)">Click+Me</a> is verified FIXED; it just gives me "Error \n Click me".

Comment 7

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.

Comment 8

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.