761114 - [wiki.mozilla.org] Semantic Forms cross site scripting

Status: RESOLVED FIXED

(Websites :: wiki.mozilla.org, defect, P2)

Description

[Sony]

Attachment: wiki.png

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20100101 Firefox/12.0
Build ID: 20120420145725

Steps to reproduce:

We have a cross site scripting on wiki mozilla.(Semantic Forms)




Actual results:

I use a simple user account. (on wiki mozilla)

Test on mozilla firefox new version.

We have a xss in https://wiki.mozilla.org/Special:CreateForm

Form name - our "field for xss".

Put our xss code in field "form name", Add template and press button add. 

our xss code :

""><script>alert("3")</script>

Video PoC:

http://youtu.be/c1QkVOUEjMQ

Comment 1

[Sony]

Also it's work in http://www.semantic-mediawiki.org/wiki/Special:CreateForm 
http://i1256.photobucket.com/albums/ii488/testfortest/123/ww.png?t=1338819700

Comment 3

[Daniel Veditz [:dveditz]]

bugs in the wiki are not eligible for the bounty. please see
http://www.mozilla.org/security/bug-bounty-faq-webapp.html#eligible-bugs

Comment 4

[Daniel Veditz [:dveditz]]

Not sure who runs wikimo or communicates bugs to Mediawiki, guessing mrz will know.

Comment 5

[Reed Loden [:reed]]

Submitted upstream as https://bugzilla.wikimedia.org/show_bug.cgi?id=38150.

Comment 6

[Brandon Burton [:solarce]]

(In reply to Reed Loden [:reed] from comment #5)
> Submitted upstream as https://bugzilla.wikimedia.org/show_bug.cgi?id=38150.

:reed, can you cc me on the upstream bug?

Comment 7

[Brandon Burton [:solarce]]

I posted an update to https://bugzilla.wikimedia.org/show_bug.cgi?id=38150 about when the next release will do, last one was 03/27/2012

Comment 9

[Andrei Hajdukewycz [:sancus]]

This appears to be fixed to me, likely by the last wiki software update.

Comment 10

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.

Comment 11

[Gordon P. Hemsley [:GPHemsley]]

Chris,

Can I please get access to https://bugzilla.wikimedia.org/show_bug.cgi?id=38150 so that I can verify if/when we've deployed the fix? (It might be that the upstream bug is also eligible to be made public.)

Comment 12

[csteipp]

(In reply to Gordon P. Hemsley [:GPHemsley] from comment #11)
> Chris,
> 
> Can I please get access to
> https://bugzilla.wikimedia.org/show_bug.cgi?id=38150 so that I can verify
> if/when we've deployed the fix? (It might be that the upstream bug is also
> eligible to be made public.)

Done. Do let me know if we can make it public-- we didn't want to do that if mozilla wasn't patched.

Comment 13

[Gordon P. Hemsley [:GPHemsley]]

Looks like this was patched in Semantic Forms 2.5 and we're running 2.6.1; we should be good to release the embargo. Thanks, Chris!