822608 - [13 XSS Vuln] hacks.mozilla.org - Cross-Site Scripting

Status: RESOLVED FIXED

(Developer Engagement :: Mozilla Hacks, task)

Description

[Artur]

Attachment: screenmozilla.jpg

User Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:17.0) Gecko/20100101 Firefox/17.0
Build ID: 20121128204232

Steps to reproduce:

Hello,

I found 8 Cross-Site Scripting in Wordpress Plugin.

URL: https://hacks.mozilla.org/wp-content/plugins/wp-syntax/geshi/contrib/cssgen.php?step=3

POST data: extra-langs=%22%3E<script>alert(0)</script>&overall=%22%3E<script>alert(1)</script>&default-styles=%22%3E<script>alert(2)</script>&keywords-1=%22%3E<script>alert(3)</script>&keywords-2=%22%3E<script>alert(4)</script>&keywords-3=%22%3E<script>alert(5)</script>&keywords-4=%22%3E<script>alert(6)</script>&comments=%22%3E<script>alert(7)</script>&escaped-chars=%22%3E<script>alert(8)</script>&brackets=%22%3E<script>alert(9)</script>&strings=%22%3E<script>alert(10)</script>&numbers=%22%3E<script>alert(11)</script>&methods=%22%3E<script>alert(12)</script>&geshi-path=%2Fdata%2Fwww%2Fhacks.mozilla.org%2Fwp-content%2Fplugins%2Fwp-syntax%2Fgeshi%2Fgeshi.php&geshi-lang-path=%2Fdata%2Fwww

These variables are vulnerable to attack:
extra-langs
overall
default-styles
keywords-1
keywords-2
keywords-3
keywords-4
comments
escaped-chars
brackets
strings
numbers
methods


Actual results:

XSS alert.


Expected results:

For example: replacing the HTML meta character with escape sequences.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

confirmed not sure on rating for this one as I think this could be an issue with the plugin

Comment 2

[Artur]

Any update ?

Comment 3

[David Chan [:dchan]]

See bug 816560 for a related issue with Geshi.

I don't believe we need docs/ and contrib/ for a functioning Geshi install. If not, we should remove those directories from the server.

http://qbnz.com/highlighter/geshi-doc.html#requirements

Comment 4

[Artur]

Yes David, you are right. This two catalogs should be removed.

Comment 5

[Artur]

There is another solution - update the plugin: 
http://wordpress.org/extend/plugins/wp-syntax/

Thanks for reply

Comment 6

[Artur]

Does this issue includes the program: http://www.mozilla.org/security/bug-bounty.html ?

Comment 8

[David Chan [:dchan]]

wp-syntax has been updated to version 1.0 which removes the test and contrib folders.
http://wordpress.org/extend/plugins/wp-syntax/changelog/

Thanks again for reporting the issue to us