598758 - 403 Error Message Vulnerable to XSS

Status: VERIFIED FIXED

(Mozilla Labs Graveyard :: FlightDeck, defect)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Issue

The 403 error message is susceptible to XSS attacks. This issue only occurs when the 403 is returned to the page and rendered within the red error box (e.g. not a generic 403 straight to the browser). One such scenario that executes the vulnerable code is where the addon name contains an XSS value and an error occurs when deleting a module. In this scenario the following is returned within the 403 body:



HTTP/1.1 403 FORBIDDEN
Date: Wed, 22 Sep 2010 21:04:31 GMT
Server: Apache/2.2.12 (Ubuntu)
Vary: Cookie,Accept-Encoding
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Content-Length: 81

There is no such module in HelloW<script>alert(1)</script>orld../../other<hr>asdf



Steps to reproduce
1. Rename an addon to contain an XSS attack
HelloW<script>alert(1)</script>done
2. Add a module to the project
3. Enable a proxy and set to intercept
4. Start to delete a module and intercept the delete message. Modify the POST parameters to gibberish values, specifically "filename"
5. Observe the error message returns and the xss fires


Recommended Resolution

Use html entity output encoding for any data displayed within the error message.

Comment 1

[Piotr Zalewa [:zalun]]

https://github.com/zalun/FlightDeck/commit/9a009698c935cdd27e9ee7a9a18d3ad12bb0d29c

Comment 2

[Michael Coates [:mcoates] (acct no longer active)]

Verified escaping used in code for the error responses and that the original test case is now safe.