463054 - (WH-1628181) XSS vulns on tiki-editpage.php

Status: VERIFIED FIXED

(support.mozilla.org :: Knowledge Base Software, task)

Description

[Reed Loden [:reed]]

Need to be logged-in for some of these to really rear their head.

http://support.mozilla.com/tiki-editpage.php?locale=en-US&page=%3C?importwhs?%3E

http://support.mozilla.com/tiki-editpage.php?locale=en-US&page=%3C?importwhs?%3E&source_page=Cookies&oldver=4&newver=11&diff_style=inlinediff-full

http://support.mozilla.com/tiki-editpage.php?page=%3C?importwhs?%3E

http://support.mozilla.com/tiki-editpage.php?page=%3C?importwhs?%3E&source_page=*%D0%9A%D1%83%D0%BA%D0%B8&oldver=1&newver=2&diff_style=inlinediff-full

https://support.mozilla.com/tiki-editpage.php?locale=en-US&page=%3C?importwhs?%3E

Comment 1

[Laura Thomson :laura]

In r19584 I merged in the new anti-XSS code from tiki 2.0.  This seems to put the kibosh on this one, although I don't really like how it works.

Will be in prod branch soon when we replace it with trunk this iteration due to the svn re-org.

Comment 2

[Reed Loden [:reed]]

Sentinel still shows an open vector for:

http://support.mozilla.com/tiki-editpage.php?page=%3Cwhscheck%3E

I can confirm:

	<div class="feature-contents">
		<div id="breadcrumbs"><ul>
		<li><a href="/kb/">Firefox Support</a></li>
		                                                              <li class="divider">/</li><li><whscheck></li>
                                      
	</ul></div>

Comment 3

[Laura Thomson :laura]

Attachment: Escape some stuff in header.tpl to solve this and future issues.

This is a common file so it might close some of the others as well, will test.

Comment 4

[Laura Thomson :laura]

In trunk r20084, prod r20085.

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

http://support.mozilla.com/tiki-editpage.php?page=%3Cwhscheck%3E from comment 2 WFM now; Verified FIXED.

Comment 6

[Dave Miller [:justdave]]

Sentinel reopened this on the last pass... listing these two urls:

http://support.mozilla.com/tiki-editpage.php?locale="whscheck="whscheck&page=*Ostala%20Firefox%20podr%C5%A1ka&source_page=Other%20Firefox%20support&oldver=21&newver=23&diff_style=inlinediff-full

http://support.mozilla.com/tiki-editpage.php?locale="whscheck="whscheck&page=*Cannot%20connect%20after%20upgrading%20Firefox

Comment 7

[James Socol [:jsocol, :james]]

Attachment: tiki-editpage.tpl

Looks like there were a couple of unescaped or incorrectly escaped variables. Fixed in both templates/styles/mozkb/tiki-editpage.tpl and templates/tiki-editpage.tpl.

Comment 8

[Michael Morgan [:morgamic]]

Comment on attachment 412030 [details] [diff] [review]
tiki-editpage.tpl

escapes for me.  I don't see another hole.

Comment 9

[James Socol [:jsocol, :james]]

r56354.

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED:

Prod: <input type="hidden" name="locale" value=""whscheck="whscheck" />
Staging: <input type="hidden" name="locale" value="&quot;whscheck=&quot;whscheck" />

For both URLs in comment 6.

Comment 11

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.

Comment 12

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.