511571 - https://creative.mozilla.org/register has an XSS vulnerability

Status: VERIFIED FIXED

(Websites :: creative.mozilla.org, defect)

Description

[:Gavin Sharp [email: [e-mail]]]

Reported on IRC by "sipher". Looks like the username is being spit back unfiltered.

Demo: http://statusbarn.com/tests/mozcxsstest.html

Should probably also be checking referrers to mitigate CSRF.

Comment 1

[Reed Loden [:reed]]

(In reply to comment #0)
> Should probably also be checking referrers to mitigate CSRF.

Checking referrers is not in any way a correct form of CSRF mitigation. The main mitigation tactic that I've seen used and that works is to use a secret, user-specific token in all form submissions.

Comment 2

[Ryan Snyder [:ryansnyder] [:rsnyder] [:rysny]]

* Adding token checking to all unauthenticated forms.
* Fixing UI for form on reset password page.

==

Sending        application/views/forgot.php
Sending        application/views/login.php
Sending        application/views/register.php
Adding         application/views/verify_reset_password.php
Sending        modules/auth/controllers/auth.php
Sending        modules/auth/views/forgot.php
Sending        modules/auth/views/login.php
Sending        modules/auth/views/register.php
Transmitting file data ........
Committed revision r49627.

Comment 3

[Ryan Snyder [:ryansnyder] [:rsnyder] [:rysny]]

Patching registration page, which was not escaping characters in form outputs.

==

Sending        application/views/register.php
Transmitting file data .
Committed revision 49628.

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Post-fix screenshot of staging

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED on http://mcc.stage.mozilla.com/register; see screenshot in comment 4.  No alert() is run, which means the script doesn't get executed.

Comment 6

[Michael Morgan [:morgamic]]

This was pushed.

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #6)
> This was pushed.

Yep; verified FIXED on prod, too: https://creative.mozilla.org/register

Comment 8

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.