Closed
Bug 612968
Opened 14 years ago
Closed 14 years ago
Topic field executes XSS
Categories
(support.mozilla.org :: Knowledge Base Software, task, P2)
Tracking
(Not tracked)
RESOLVED
FIXED
2.3
People
(Reporter: rbillings, Assigned: erik)
Details
(Keywords: wsec-xss)
uTest user was able to get xss to execute using the topic field on a new article. I was unable to repro using WinXP and either IE or FF, but this is serious enough to warrant even more exploration.
1) /kb/new
2) enter ""><script>alert("Hacked");</script>" in the topic field
3) submit article for review [with other req'd fields]> enter reason> submit
expected: article created
actual: uTest got it to execute, I was unable to repro
Updated•14 years ago
|
Severity: normal → critical
Priority: -- → P2
Updated•14 years ago
|
Group: websites-security
Assignee | ||
Updated•14 years ago
|
Assignee: nobody → erik
Assignee | ||
Comment 1•14 years ago
|
||
Aha, the trick is that the tested submitted an invalid tag (which means they weren't a privileged user, as you and I are). Notice the error message 'Select a valid choice.">'. We need to escape the error message better or something.
Assignee | ||
Comment 2•14 years ago
|
||
Same thing happens if you edit the HTML and put in a XSS-ish value for any other ChoiceField.
Comment 3•14 years ago
|
||
(In reply to comment #2)
> Same thing happens if you edit the HTML and put in a XSS-ish value for any
> other ChoiceField.
If you have to edit the HTML it's not a vulnerability.
Assignee | ||
Comment 4•14 years ago
|
||
Of course not. Just making the point that the escaping is globally wrong. Fixed it in errorlist.html.
Assignee | ||
Comment 5•14 years ago
|
||
Landed on master (https://github.com/jsocol/kitsune/commit/5ce0ddead4ae9f50f38ae9add8f4812b421488e2) and 2.3.x (https://github.com/jsocol/kitsune/commit/0c9db39fb30863600b60f703d48f3f0408a5eeb5).
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Comment 6•12 years ago
|
||
Adding keywords to bugs for metrics, no action required. Sorry about bugmail spam.
Keywords: wsec-xss
Comment 7•9 years ago
|
||
These bugs are all resolved, so I'm removing the security flag from them.
Group: websites-security
You need to log in
before you can comment on or make changes to this bug.
Description
•