468623 - (WH-1659711) XSS vulns on tiki-view_forum_thread.php

Status: VERIFIED FIXED

(support.mozilla.org :: Knowledge Base Software, task)

Description

[Reed Loden [:reed]]

http://support.mozilla.com/tiki-view_forum_thread.php?locale=en-US&forumId=3&comments_threshold=0&comments_reply_threadId=200202&comments_offset=0&thread_sort_mode=commentDate_asc&comments_per_page=20&comments_grandParentId=%22%20STYLE=%22background-image:%20x(a:whs())&comments_parentId=198544&thread_style=commentStyle_plain&post_reply=1
http://support.mozilla.com/tiki-view_forum_thread.php?locale=en-US&forumId=3&comments_threshold=0&comments_reply_threadId=198623&comments_offset=0&thread_sort_mode=commentDate_asc&comments_per_page=20&comments_grandParentId=%22%20STYLE=%22background-image:%20x(a:whs())&comments_parentId=198281&thread_style=commentStyle_plain&post_reply=1

http://support.mozilla.com/tiki-view_forum_thread.php?locale=en-US&forumId=3&comments_threshold=%22%20STYLE=%22background-image:%20x(a:whs())&comments_reply_threadId=200202&comments_offset=0&thread_sort_mode=commentDate_asc&comments_per_page=20&comments_grandParentId=198544&comments_parentId=198544&thread_style=commentStyle_plain&post_reply=1
http://support.mozilla.com/tiki-view_forum_thread.php?locale=en-US&forumId=3&comments_threshold=%22%20STYLE=%22background-image:%20x(a:whs())&comments_reply_threadId=198623&comments_offset=0&thread_sort_mode=commentDate_asc&comments_per_page=20&comments_grandParentId=198281&comments_parentId=198281&thread_style=commentStyle_plain&post_reply=1

Comment 1

[E. Cooper [:ecooper]]

Attachment: Escapes params that output direct from the url

Escaped post footer and admin action links

Comment 2

[Laura Thomson :laura]

In trunk r21580, prod r21581.

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED on staging, thanks!

Comment 4

[Reed Loden [:reed]]

'comments_threshold' param

http://support.mozilla.com/tiki-view_forum_thread.php?locale=en-US&forumId=1&comments_threshold=%22whscheck=%22whscheck()&comments_parentId=2046&comments_offset=20&comments_per_page=20&thread_style=commentStyle_plain

Comment 5

[Reed Loden [:reed]]

				<div class="mini">
		
							<a class="prevnext" href="/tiki-view_forum_thread.php?locale=en-US&amp;forumId=1&amp;comments_threshold="whscheck="whscheck()&amp;comments_parentId=2046&amp;comments_offset=0&amp;comments_per_page=20&amp;thread_style=commentStyle_plain">« Prev</a>

			
																							<a class="prevnext" href="/tiki-view_forum_thread.php?locale=en-US&amp;forumId=1&amp;comments_threshold="whscheck="whscheck()&amp;comments_parentId=2046&amp;comments_offset=0&amp;comments_per_page=20&amp;thread_style=commentStyle_plain">1</a>
																									<span class="current_page">2</span>
																									<a class="prevnext" href="/tiki-view_forum_thread.php?locale=en-US&amp;forumId=1&amp;comments_threshold="whscheck="whscheck()&amp;comments_parentId=2046&amp;comments_offset=40&amp;comments_per_page=20&amp;thread_style=commentStyle_plain">3</a>
																									<a class="prevnext" href="/tiki-view_forum_thread.php?locale=en-US&amp;forumId=1&amp;comments_threshold="whscheck="whscheck()&amp;comments_parentId=2046&amp;comments_offset=60&amp;comments_per_page=20&amp;thread_style=commentStyle_plain">4</a>
																									<a class="prevnext" href="/tiki-view_forum_thread.php?locale=en-US&amp;forumId=1&amp;comments_threshold="whscheck="whscheck()&amp;comments_parentId=2046&amp;comments_offset=80&amp;comments_per_page=20&amp;thread_style=commentStyle_plain">5</a>
												
							<a class="prevnext" href="/tiki-view_forum_thread.php?locale=en-US&amp;forumId=1&amp;comments_threshold="whscheck="whscheck()&amp;comments_parentId=2046&amp;comments_offset=40&amp;comments_per_page=20&amp;thread_style=commentStyle_plain">Next »</a>

			 

		</div>

Comment 6

[Reed Loden [:reed]]

Attachment: Fix issue found in comment #4 along with other fixes - v1

Comment 7

[Laura Thomson :laura]

1.0 is frozen and going out tomorrow, 1.1 freezes tomorrow and goes out next week.  Pushing to 1.1.

Comment 8

[Reed Loden [:reed]]

(In reply to comment #7)
> 1.0 is frozen and going out tomorrow, 1.1 freezes tomorrow and goes out next
> week.  Pushing to 1.1.

Now that 1.0 is 0.9.5, does that mean 1.0 is going out next week? I would like this reviewed and pushed as soon as possible, especially considering how long the past ones have been delayed.

Comment 9

[E. Cooper [:ecooper]]

Comment on attachment 368846 [details] [diff] [review]
Fix issue found in comment #4 along with other fixes - v1

Sorry for the delay.

Looks good.

Comment 10

[Reed Loden [:reed]]

r23752/r23753

Comment 11

[Stephen Donner [:stephend] Not actively reading bugmail]

Staging (http://support-stage.mozilla.org/tiki-view_forum_thread.php?locale=en-US&forumId=1&comments_threshold=%22whscheck=%22whscheck%28%29&comments_parentId=2046&comments_offset=20&comments_per_page=20&thread_style=commentStyle_plain):

<a class="prevnext" href="/tiki-view_forum_thread.php?locale=en-US&amp;forumId=1&amp;comments_threshold=%22whscheck%3D%22whscheck%28%29&amp;comments_parentId=2046&amp;comments_offset=0&amp;comments_per_page=20&amp;thread_style=commentStyle_plain">« Prev</a>

Verified FIXED

Comment 12

[Dave Miller [:justdave]]

Sentinel claims this vulnerability was re-introduced on 2009-09-28.

Vulnerable URLS:

http://support.mozilla.com/tiki-view_forum_thread.php?forumId=1&comments_parentId=215839&comments_grandParentId=%22whscheck=%22whscheck&comments_reply_threadId=215839&comments_offset=0&forumId=1
https://support.mozilla.com/tiki-view_forum_thread.php?comments_parentId=463957&%22whscheck=%22whscheck&forumId=1
http://support.mozilla.com/tiki-view_forum_thread.php?forumId=1&comments_parentId=215839&comments_grandParentId=&comments_reply_threadId=%22whscheck=%22whscheck&comments_offset=0&forumId=1
http://support.mozilla.com/tiki-view_forum_thread.php?locale=en-US&forumId=3&%22whscheck=%22whscheck&comments_parentId=431655&watch_event=forum_post_thread&watch_object=431655&watch_action=add
https://support.mozilla.com/tiki-view_forum_thread.php?locale=%22whscheck=%22whscheck&comments_parentId=198326&forumId=1
https://support.mozilla.com/tiki-view_forum_thread.php?locale=%22whscheck=%22whscheck&forumId=1&comments_parentId=459192&watch_event=forum_post_thread&watch_object=459192&watch_action=add
https://support.mozilla.com/tiki-view_forum_thread.php?locale=en-US&forumId=1&comments_parentId=459192&watch_event=forum_post_thread&watch_object=459192&watch_action=%22whscheck=%22whscheck
https://support.mozilla.com/tiki-view_forum_thread.php?locale=en-US&forumId=1&comments_parentId=459192&watch_event=%22whscheck=%22whscheck&watch_object=459192&watch_action=add
https://support.mozilla.com/tiki-view_forum_thread.php?locale=en-US&forumId=1&comments_parentId=459192&watch_event=forum_post_thread&watch_object=%22whscheck=%22whscheck&watch_action=add
http://support.mozilla.com/tiki-view_forum_thread.php?locale=en-US&forumId=3&comments_parentId=431655&watch_event=forum_post_thread&watch_object=%22whscheck=%22whscheck&watch_action=add

Comment 13

[James Socol [:jsocol, :james]]

We've had two releases since 2009-09-28 and a lot of these are looking closed--in several of them, I don't see "whscheck" in the output at all. Is there anything more up to date?

Comment 14

[James Socol [:jsocol, :james]]

A WHS scan on 11/12 says this vulnerability is closed (see the XSS bugs in 1.4.2).

Comment 15

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified per comment 14 (James said he conferred with justdave).

Comment 16

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.

Comment 17

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.