598737 - Escaping Needed to Prevent Reflected XSS via cmd_cli search

Status: RESOLVED INCOMPLETE

(Skywriter Graveyard :: Embedded, defect)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Issue

A reflected cross site scripting vulnerability is present within the command line interface portion of the flightdeck website.  Aside from an attacker convincing a user to copy and paste a specific string into the input (which sadly could work), it is not clear how an attacker would realistically exploit this vulnerability. However, the issue should still be addressed none-the-less.

Steps to reproduce
1. View the source of any add-on
2. Enter the following into the command line text box at the bottom of the screen:
<hr><script>alert(document.cookie)</script>
3. Observe the "no matches for" window appears and the script fires the alert box


Recommended Resolution

Configure the error box to safely output encode the user supplied data so that html is displayed literally instead of being interpreted by the browser.

Comment 1

[Piotr Zalewa [:zalun]]

This might be a bespin issue

Comment 2

[Daniel Buchner [:dbuc]]

This seems like an exploit that would rely on a full breach or direct user interaction to produce the effect described. Being that a full breach would lead to more direct attacks and other more sever attacks, I am inclined to wave this for the next release as Bespin will be merging with Cloud9 and this should no longer be and issue.

If a developer would do this "convincing a user to copy and paste a specific string into the input" then Firebug's own command line would then technically be a vulnerable interface. This is something I am willing to live with for now.

Comment 3

[Michael Coates [:mcoates] (acct no longer active)]

Yes, this would most likely rely on either direct user interaction or a clickjacking style attack where the user is entering text but its confusing where the data is going.

You marked this as resolved fixed. Did you decide to fix it?  If not, then I'd like it to remain open and be assigned to a future target milestone.

Comment 4

[Daniel Buchner [:dbuc]]

This is really a function of Bespin, and given the narrow vector of attack I marked it Fixed. I will reopen it as Incomplete, and close it when Skywriter merges with Cloud9's editor (which will "fix it" in the process).