1264172 - https://crash-stats.mozilla.com Reflected XSS via SuperSearch API

Status: RESOLVED DUPLICATE of bug 1263421

(Websites :: Other, defect)

Description

[Sean Melia]

Attachment: XSS Prompt Box PoC

The crash-stats.mozilla.com subdomain is vulnerable to reflected cross-site scripting via the date parameter with the following payload: <script>prompt(document.domain)</script>

1. Visit https://crash-stats.mozilla.com/api/SuperSearch/?product=Firefox&version=46.0b10&date=%3E%3d2016-04-05%3Cscript%3Eprompt%28document.domain%29%3C/script%3E&date=%3C2016-04-13&_histogram.date=version&_results_number=0

Comment 1

[Adam Muntner [:adamm] (use NEEDINFO)]

Thanks for your report Sean.

I don't see the response rendering in an executable context in the browser, just an error:

{"error": "Bad value for parameter date: \"2016-04-05<script>prompt(document.domain)</script>\" is not a valid datetime"}

Are you seeing something more than this?

Comment 2

[Sean Melia]

Looks like this was fixed silently. Content type in the response changed from html to json...

Comment 3

[Adam Muntner [:adamm] (use NEEDINFO)]

Sean,

Thanks again for the report. 

I checked the repo on Github,  discussion about the change is here: https://github.com/mozilla/socorro/pull/3287

I checked page accesses, the developer didn't visit the bug. 

Keep an eye on the FAQ page, I made a pull req today to update the eligible host list for the bounty program. Once the site maintainers approve it, it'll be up. https://www.mozilla.org/en-US/security/bug-bounty/faq-webapp/

Comment 4

[Sean Melia]

I'm a little confused by this. Just because the developer didn't visit the page doesn't mean he wasn't given this information. He could have seen the logs on the server and noticed this issue. He pushed out a fix the day after I reported this bug. Is this eligible for a bounty or no?

Comment 5

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

Sean/Adam: The bug was fixed during a big overhaul that was sparked while fixing another XSS in the same app reported a couple days before.  See Bug #1263421 for details on that.  This should help explain the concerns above, just very close timing on the submissions (~3 days apart).  The PR adam mentions above was the final PR of two attempts to fix this, original PR was this (https://github.com/mozilla/socorro/pull/3286).

Comment 6

[Sean Melia]

Okay thanks for the clarification.