1254226 - XSS through javascript: callback URLs in auth delegation

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect)

Description

[Wladimir Palant]

This issue can be reproduced if the Bugzilla instance has auth delegation enabled, consider the following link for example:

> https://bugzilla.mozilla.org/auth.cgi?callback=javascript:alert%28/xss/%29&description=foobar

Clicking the link will produce a message saying "xss." The issue is not too critical because the link title gives it away and obfuscation possibilities are limited, still a vulnerability however. Vanilla Bugzilla instances are affected as well, landfill.bugzilla.org doesn't have auth.cgi however.

Note that auth.cgi only allows HTTP and HTTPS as callbacks, the corresponding check only happens when confirming delegation however.

Comment 1

[Frédéric Buclin]

Hum, where do you see the "xss" message? Clicking this link generates a page with:

 A third-party website (javascript:alert(/xss/)) would like to have complete access to your Bugzilla account.

The description of the site reads:

    foobar 

Do you want this website to have complete access to your Bugzilla account?


But no alert() is triggered.

Comment 2

[Wladimir Palant]

The alert is produced if you click the website link on this page.

Comment 3

[Frédéric Buclin]

Attachment: patch, v1

Comment 4

[Dylan Hardison [:dylan] (he/him)]

Comment on attachment 8727580 [details] [diff] [review]
patch, v1

Review of attachment 8727580 [details] [diff] [review]:
-----------------------------------------------------------------

r=dylan

Comment 5

[Frédéric Buclin]

Why is this bug tagged sec-high? Not only must the victim first load a page such as the one described in comment 0, but then the victim must also click the URL displayed in that page to trigger XSS. So it requires two actions from the user. Being an authentication page, I doubt one would click on a link asking for full access to your account when the website name is "javascript:alert(/xss/)". XSS is not triggered when loading the initial page; only when clicking on the "javascript:alert(/xss/)" link.

FYI, there is no Bugzilla release with that code yet as it's in master only.

Comment 6

[Wladimir Palant]

(In reply to Frédéric Buclin from comment #5)
> FYI, there is no Bugzilla release with that code yet as it's in master only.

Seems to be correct but BMO is using this already. The rest - not up to me.

Comment 7

[Frédéric Buclin]

To ssh://[e-mail]/bugzilla/bugzilla.git
   c7e8031..3368986  master -> master