463055 - (WH-1628152) XSS vulns on tiki-listpages.php

Status: VERIFIED FIXED

(support.mozilla.org :: Knowledge Base Software, task)

Description

[Reed Loden [:reed]]

https://support.mozilla.com/tiki-listpages.php?offset=%22%20STYLE=%22background-image:%20x(a:whs())&sort_mode=pageName_asc&maxRecords=10

Comment 1

[Laura Thomson :laura]

r19584 fixed this one too.

Comment 2

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED on https://support-stage.mozilla.org/tiki-listpages.php?offset=%22%20STYLE=%22background-image:%20x%28a:whs%28%29%29&sort_mode=pageName_asc&maxRecords=10:

Notice: invalid variable value: $_GET["offset"] = " STYLE="background-image: x(a:whs())

Comment 3

[Reed Loden [:reed]]

Still some open vectors:

http://support.mozilla.com/tiki-listpages.php?initial=%22%20STYLE=%22background-image:%20x(a:whs())&maxRecords=10&sort_mode=pageName_asc
https://support.mozilla.com/tiki-listpages.php?offset=0&sort_mode=user_desc&initial=%22%20STYLE=%22background-image:%20x(a:whs())&maxRecords=10
http://support.mozilla.com/tiki-listpages.php?offset=0&sort_mode=pageName_asc&initial=%22%20STYLE=%22background-image:%20x(a:whs())&maxRecords=10

http://support.mozilla.com/tiki-listpages.php?offset=%22%20STYLE=%22background-image:%20x(a:whs())&sort_mode=pageName_asc&maxRecords=10
https://support.mozilla.com/tiki-listpages.php?offset=%22%20STYLE=%22background-image:%20x(a:whs())&sort_mode=pageName_desc&maxRecords=10
https://support.mozilla.com/tiki-listpages.php?offset=%22%20STYLE=%22background-image:%20x(a:whs())&sort_mode=user_desc&initial=i&maxRecords=10
http://support.mozilla.com/tiki-listpages.php?offset=%22%20STYLE=%22background-image:%20x(a:whs())&sort_mode=lang_desc
http://support.mozilla.com/tiki-listpages.php?offset=%22%20STYLE=%22background-image:%20x(a:whs())&sort_mode=pageName_asc&initial=w&maxRecords=10
http://support.mozilla.com/tiki-listpages.php?offset=%22%20STYLE=%22background-image:%20x(a:whs())&sort_mode=pageName_desc&maxRecords=10

Comment 4

[Paul Craciunoiu [:paulc]]

Resolved as per Bug 463068 -  (WH-1628438) XSS vulns on tiki-orphan_pages.php
r21561/r21562

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

I don't get it; all of the URLs in comment 3 give me "invalid variable value" whether or not I'm logged in (similar to comment 2).

Comment 6

[Reed Loden [:reed]]

(In reply to comment #5)
> I don't get it; all of the URLs in comment 3 give me "invalid variable value"
> whether or not I'm logged in (similar to comment 2).

Scroll down.

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED with the URLs in comment 3 changed to use support-stage; thanks to Reed for pointing out the obvious in comment 6, I was able to see the problem on production but not on staging.

Comment 8

[Reed Loden [:reed]]

Sentinel found that the categId param isn't being properly escaped.

https://support.mozilla.com/tiki-listpages.php?sort_mode=pageName_asc&offset=3020&find=&lang=&categId=%22whscheck=%22whscheck()&maxRecords=10&search=Find

http://support.mozilla.com/tiki-listpages.php?sort_mode=pageName_asc&find=&lang=&categId=%22whscheck=%22whscheck%28%29&maxRecords=10&search=Find

Comment 9

[Reed Loden [:reed]]

Attachment: Escape 'categId' param - v1

Comment 10

[E. Cooper [:ecooper]]

Comment on attachment 361237 [details] [diff] [review]
Escape 'categId' param - v1

Ideally, we should be using {$var|escape:"url"} for variables being displayed in link urls, but it's irrelevant in this case. 'categId' should only be passed integers, anyway.

Comment 11

[Reed Loden [:reed]]

Attachment: Escape 'categId' param and fix 'find' param escape - v2

I changed my usage to escape:"url", as well as fixing the usage of the 'find' param's escapage. Carrying over review. I'll commit this shortly.

Comment 12

[Reed Loden [:reed]]

Committed as r22119 / r22120.

Comment 13

[Reed Loden [:reed]]

'find' param

http://support.mozilla.com/tiki-listpages.php?sort_mode=pageName_asc&find=%00%22whscheck=%22whscheck()&lang=&categId=&maxRecords=10&search=Find

Comment 14

[Reed Loden [:reed]]

              <td style="text-align:right;" class="heading"><a class="tableheading" href="/tiki-listpages.php?offset=0&amp;sort_mode=lang_desc&amp;find="whscheck="whscheck()">Language</a>
      </td>

Comment 15

[Reed Loden [:reed]]

My patch in bug 463068 takes care of this one, too.

stephend, please QA.

Comment 16

[Stephen Donner [:stephend] Not actively reading bugmail]

On staging:

 <td style="text-align:right;" class="heading"><a class="tableheading" href="/tiki-listpages.php?offset=3020&amp;sort_mode=lang_desc&amp;find=%22whscheck%3D%22whscheck%28%29">Language</a>
      </td>

Verified FIXED on http://support-stage.mozilla.org/tiki-listpages.php?sort_mode=pageName_asc&find=%22whscheck%3D%22whscheck%28%29&lang=&categId=&maxRecords=10&search=Find

Comment 17

[Reed Loden [:reed]]

Another one...

    Create Page: <a href="/tiki-editpage.php?page="whscheck="whscheck()" title="Create"> "whscheck="whscheck()</a>

Comment 18

[Reed Loden [:reed]]

Attachment: Fix issue found in comment #17 - v1

Definitely needs QA, as I worry about the double quotes here...

<a href="tiki-editpage.php?page={$find|escape:"url"}"

Should I use escape:'url' there, or is it fine as-is?

Comment 19

[E. Cooper [:ecooper]]

Comment on attachment 369218 [details] [diff] [review]
Fix issue found in comment #17 - v1

The use of "" is fine since it's within something parsed by smarty.

The patch behaves as expected locally.

Comment 20

[Reed Loden [:reed]]

r23794/r23795

Comment 21

[Stephen Donner [:stephend] Not actively reading bugmail]

How do I trigger comment 17?  URL, please?

Comment 22

[Reed Loden [:reed]]

(In reply to comment #21)
> How do I trigger comment 17?  URL, please?

http://support.mozilla.com/tiki-listpages.php?sort_mode=pageName_asc&find=%00%22whscheck=%22whscheck()&lang=&categId=&maxRecords=10&search=Find

Need to be logged-in, though.

Comment 23

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED;

https://support-stage.mozilla.org/tiki-listpages.php?sort_mode=pageName_asc&find=%22whscheck%3D%22whscheck%28%29&lang=&categId=&maxRecords=10&search=Find has:

Create Page: <a href="/tiki-editpage.php?page=%22whscheck%3D%22whscheck%28%29" title="Create"> &quot;whscheck=&quot;whscheck()</a>

Comment 24

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.

Comment 25

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.