767167 - Persistent XSS with SVG files on http://wiki.mozilla.org

Status: RESOLVED FIXED

(Websites :: wiki.mozilla.org, defect)

Description

[Mario Gomes]

Hello,

Persistent Cross Site Scripting(XSS) on SVG files. This can allow attackers to execute javascript codes on as orign wiki.mozilla.org.

PoC: https://wiki.mozilla.org/images/d/da/File.svg

Cheers,
Mario.

Comment 1

[Mario Gomes]

Tested On: Chrome, Safari and Opera.

Comment 2

[Mario Gomes]

Is it a duplicate?

Comment 3

[Matt Fuller :mfuller]

I don't think it's a duplicate, he's saying it will be fixed when the update described in that bug is pushed.

Comment 4

[Mario Gomes]

Well, I know that this site is not listed on bountable list(https://www.mozilla.org/security/bug-bounty-faq-webapp.html#eligible-bugs), but also was said "...If the bug is extraordinary, we might still consider the bug to be nominated for a bounty...". So, can this be eligible for a bounty?

Comment 5

[Matt Fuller :mfuller]

The bug bounty committee is meeting today and will decide whether the bug is eligible. Thank you for reporting, we will contact you if it is.

Comment 7

[Mario Gomes]

Okay. Thanks you.

(In reply to Matt Fuller from comment #5)
> The bug bounty committee is meeting today and will decide whether the bug is
> eligible. Thank you for reporting, we will contact you if it is.

Comment 9

[Mario Gomes]

This file(https://wiki.mozilla.org/images/e/e0/XSS.svg) works on Firefox, Chrome, Safari, Opera and IE9(well, on IE crash the browser).

Comment 10

[chris hofmann]

Mario,

We believe this does not qualify for a bounty based on that it is a dupe of http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-June/000116.html and the site is normally not on the list of qualifying sites.

Thanks for reporting and keep us aware that we need to update our installation as soon as possible.

Comment 11

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.

Comment 12

[Gordon P. Hemsley [:GPHemsley]]

Reopening because this is/was a valid bug.

Comment 13

[Mario Gomes]

It doesnt reproduce anymore. You can close this as 'fixed'.

Comment 14

[Christie Koehler [:ckoehler]]

I've confirmed that it's no longer possible to upload svg files with this exploit. I've also removed the sample file from the wiki.