790099 - Etherpad SecReview - Open Redirect on Sign-in Page

Status: RESOLVED FIXED

(Websites Graveyard :: etherpad.mozilla.org, defect)

Description

[Matt Fuller :mfuller]

Filing this bug as a reminder for when I do the sec review.

Etherpad allows an open redirect to any website:

https://security.etherpad.mozilla.org/ep/account/sign-in?cont=http://bad-site-with-malware.com

Doesn't require a signin either. Redirects immediately.

Comment 1

[Robert Helmer [:rhelmer]]

Looks pretty easy to do a check against the configured "topdomains" (e.g. using domainEnabled(request.domain) )

It would be worth looking through the source to see where else redirects are used, I see at least a few places where strings are concatenated so those would need to be traced down. 

I suspect that all of the old "pro" code was written with the expectation that it would not be public in the way ours is, since it was a paid feature originally...

Comment 2

[Matt Fuller :mfuller]

Hi Robert,

Thanks for the reply - don't worry about fixing this at the moment; we're gathering security bugs related to etherpad in prerparation for a full security review and possible switch to etherpad lite or new product due to the number of insecurities in etherpad.

Comment 3

[:Atoll]

This product has been shutdown and is no longer available. For the record, this product is not part of the bug bounty program.