612713 - Reflected XSS in https://addons.mozilla.org/

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Public Pages, defect)

Description

[Ervis Tusha]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.12) Gecko/20101027 Ubuntu/10.10 (maverick) Firefox/3.6.12
Build Identifier: 

https://addons.mozilla.org/en-US/firefox/browse/type:1/cat:22/sort:popular/%22%20onmouseover=%22alert%281%29%22

Reproducible: Always

Steps to Reproduce:
1.https://addons.mozilla.org/en-US/firefox/browse/type:1/cat:22/sort:popular/%22%20onmouseover=%22alert%281%29%22
2.
3.

Comment 1

[Ervis Tusha]

sorry mark this as security bug

Comment 2

[Michael Coates [:mcoates] (acct no longer active)]

Confirmed this is firing. Simply follow the above link and move the mouse around the page.

Comment 3

[Michael Coates [:mcoates] (acct no longer active)]

This issue is being addressed.

Comment 4

[Wil Clouser [:clouserw]]

(In reply to comment #3)
> This issue is being addressed.

It's actually fixed.  That page is an old PHP page that is still hanging around.  We expanded the limit on the rewrite (removed the $) to accept all URLs and send them to the new python code.  Thanks.

Comment 5

[Michael Coates [:mcoates] (acct no longer active)]

Verified the fix.
Front end caching may show the original attack to still fire for a bit. Simply changing any part of the url will bypass front end caching and then safely redirect away.

Example:
https://addons.mozilla.org/en-US/firefox/browse/type:1/cat:22/sort:popular/" onmouseover="alert(12)"

Comment 6

[Michael Coates [:mcoates] (acct no longer active)]

Verified the fix.
Front end caching may show the original attack to still fire for a bit. Simply changing any part of the url will bypass front end caching and then safely redirect away.

Example:
https://addons.mozilla.org/en-US/firefox/browse/type:1/cat:22/sort:popular/" onmouseover="alert(12)"

Comment 8

[Ervis Tusha]

confirm bug is fixed :)

Comment 9

[Reed Loden [:reed]]

How did this bug get fixed? What are the specific commits that fixed it? Why is none of that information in this bug?

Comment 10

[Reed Loden [:reed]]

(In reply to comment #9)
> How did this bug get fixed? What are the specific commits that fixed it? Why is
> none of that information in this bug?

From initial read-through, it looks like that URL path was just swapped from remora over to zamboni (comment #4). Was that indeed the fix? Purely a server-side change?

Comment 11

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.