612968 - Topic field executes XSS

Status: RESOLVED FIXED

(support.mozilla.org :: Knowledge Base Software, task, P2)

Description

[Rebecca Billings [:rbillings]]

uTest user was able to get xss to execute using the topic field on a new article. I was unable to repro using WinXP and either IE or FF, but this is serious enough to warrant even more exploration.

1) /kb/new
2) enter ""><script>alert("Hacked");</script>" in the topic field
3) submit article for review [with other req'd fields]> enter reason> submit

expected: article created
actual: uTest got it to execute, I was unable to repro

Comment 1

[Erik Rose [:erik][:erikrose]]

Aha, the trick is that the tested submitted an invalid tag (which means they weren't a privileged user, as you and I are). Notice the error message 'Select a valid choice.">'. We need to escape the error message better or something.

Comment 2

[Erik Rose [:erik][:erikrose]]

Same thing happens if you edit the HTML and put in a XSS-ish value for any other ChoiceField.

Comment 3

[James Socol [:jsocol, :james]]

(In reply to comment #2)
> Same thing happens if you edit the HTML and put in a XSS-ish value for any
> other ChoiceField.

If you have to edit the HTML it's not a vulnerability.

Comment 4

[Erik Rose [:erik][:erikrose]]

Of course not. Just making the point that the escaping is globally wrong. Fixed it in errorlist.html.

Comment 5

[Erik Rose [:erik][:erikrose]]

Landed on master (https://github.com/jsocol/kitsune/commit/5ce0ddead4ae9f50f38ae9add8f4812b421488e2) and 2.3.x (https://github.com/jsocol/kitsune/commit/0c9db39fb30863600b60f703d48f3f0408a5eeb5).

Comment 6

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.

Comment 7

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.