1254542 - Reflected XSS in comment-remo-form-payment.txt page

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: Extensions, defect)

Description

[Wladimir Palant]

You can see this issue live under the following URL:

> https://bugzilla.mozilla.org/page.cgi?id=comment-remo-form-payment.txt&firstname=%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E

I have the impression that this template got placed in the wrong directory and isn't meant to be a page at all. Problem is, despite the .txt file extension it is served with Content-Type: text/html. And it inserts data from the query string without performing any escaping whatsoever...

Comment 1

[Dylan Hardison [:dylan] (he/him)]

There is another *.txt.tmpl available over page.cgi:

./extensions/BMO/template/en/default/pages/group_membership.txt.tmpl

Comment 2

[Dylan Hardison [:dylan] (he/him)]

can group names be malicious? or logins? maybe not, but https://bugzilla.mozilla.org/page.cgi?id=group_membership.txt&who=dylan%40mozilla.com&output=txt is still served with an html content type and performs no escaping too. We should fix both in this bug.

Comment 3

[Gervase Markham [:gerv]]

Aah, arse. I really thought I'd protected against this sort of thing, but seems like I didn't. :-( We need to stop support files like the txt.tmpl ones being called directly by page.cgi, because they aren't designed for that. But also, why on earth are they ending up with a html content-type - they clearly are .txt.tmpl, so I'd expect text/plain. Haven't researched this yet.

Gerv

Comment 4

[Wladimir Palant]

(In reply to Dylan William Hardison [:dylan] from comment #1)
> There is another *.txt.tmpl available over page.cgi:
> 
> ./extensions/BMO/template/en/default/pages/group_membership.txt.tmpl

Yes, I looked at this one as well - also served up as text/html, doesn't seem to be exploitable however.

Comment 5

[Dylan Hardison [:dylan] (he/him)]

Attachment: 1254542_1.patch

note: this should be upstreamed as well.

Comment 6

[David Lawrence [:dkl]]

Comment on attachment 8728131 [details] [diff] [review]
1254542_1.patch

Review of attachment 8728131 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl

Comment 7

[Dylan Hardison [:dylan] (he/him)]

To ssh://[e-mail]/webtools/bmo/bugzilla.git
   6ec9ecf..0b7cd97  master -> master

Comment 8

[David Lawrence [:dkl]]

Pushed