619635 - persistent xss via the username field at https://l10n.mozilla.org/narro/narro_user_list.php?l=en-US&s=

Status: RESOLVED FIXED

(Websites :: other.mozilla.org, defect)

Description

[David]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101210 4
Build Identifier: 

persistent xss via the username field at  https://l10n.mozilla.org/narro/narro_user_list.php?l=en-US&s=



Reproducible: Always

Steps to Reproduce:
persistent xss via the username field at  https://l10n.mozilla.org/narro/narro_user_list.php?l=en-US&s=


Actual Results:  
persistent xss via the username field at  https://l10n.mozilla.org/narro/narro_user_list.php?l=en-US&s=



Expected Results:  
don't get xssed!

Comment 1

[David]

https://l10n.mozilla.org/narro/narro_user_profile.php?l=en-US&u=791 --> (e.g.) --> username was  username:<!--<img src="--><img src=x onerror=alert(1)//">

Comment 2

[David]

actually woops, it was https://l10n.mozilla.org/narro/narro_user_profile.php?l=en-US&u=792

Comment 4

[Michael Coates [:mcoates] (acct no longer active)]

Confirmed stored xss at example https://l10n.mozilla.org/narro/narro_user_profile.php?l=en-US&u=792

Comment 5

[David]

I filed this upstream at --> http://code.google.com/p/narro/issues/detail?id=170

Comment 6

[Daniel Veditz [:dveditz]]

If narro is more than an experimental tool it needs to live on its own server (narro.mozilla.org?) so it's not vulnerable to problems with the rest of l10n.mozilla.org, and vice versa.

Comment 7

[Axel Hecht [:Pike]]

Agreed, it started off as an experiment, but we're past that.

Comment 8

[Michael Coates [:mcoates] (acct no longer active)]

Issue still present. No movement on filed bug.
http://code.google.com/p/narro/issues/detail?id=170

Comment 10

[chris hofmann]

alex,  any idea on a fix for this.  we are starting to get dupes from security researchers.

Comment 11

[Raymond Forbes[:rforbes]]

ping.  any update on this?

Thanks!

Comment 12

[Raymond Forbes[:rforbes]]

ping again on this.

thanks!

Comment 13

[Michael Coates [:mcoates] (acct no longer active)]

Issue is still present.

We'll need to patch this issue locally since it is not gaining traction at the project.  We need an eta this week of when this can happen. 


POC:
https://l10n.mozilla.org/narro/narro_user_profile.php?l=en-US&u=957

Comment 14

[Yvan Boily [:ygjb][:yvan]]

Reached out to [e-mail] to offer to help identify what needs to be fixed (he is the maintainer for narro).

Comment 15

[Laura Thomson :laura]

I asked Brandon Savage to spin up a patch.

Comment 17

[Axel Hecht [:Pike]]

OK, with the update to the narro install, I can't reproduce this anymore, because the file is gone. What's up next with this bug?

Comment 18

[Alexandru Szasz]

Fixed in http://code.google.com/p/narro/source/detail?r=bee28e9aff531bfed72fe2c36f212bf86432fbd2 and updated the code on lmo.

The URL changed, you can confirm it here: https://l10n.mozilla.org/narro/user.php?l=en-US&u=957

Comment 19

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.