956546 - Reflected Cross Site Scripting

Status: RESOLVED DUPLICATE of bug 765340

(Webmaker Graveyard :: webmaker.org, defect)

Description

[Garry D. Bacalso]

Attachment: POC.zip

Good Day Webmaster,

 

I would like to report a bug of your site webmaster, because i am concern for this site, 

and to protect the name of your site. 

I found a 2 time bug to your site. That having bug could a Reflected XSS vulnerable, and it can cause and inserting malicious script to your site.

Please do and action with this bug report webmaster.

OS:

windows 7

Browser:
Mozilla Firefox Version 27.0


Respectfully yours,
Garry D. Bacalso

Comment 1

[Garry D. Bacalso]

Please see the attached files that i attached. for POC

Comment 2

[Chris DeCairos (:cade)]

Javascript in Thimble is an enabled feature. Any JavaScript running in that preview frame is properly sandboxed on a completely different domain than webmaker.org, and the behaviour in the attached video is expected.

Jon/Pomax - wont-fix?

Comment 3

[Garry D. Bacalso]

Good Day Webmaster,

Would it be qualified for bug bounty reward webmaster?
Did you see the video that i attached webmaster?


Respectfully yours,
Garry D. Bacalso

Comment 4

[Garry D. Bacalso]

(In reply to Chris DeCairos (:cade) from comment #2)
> Javascript in Thimble is an enabled feature. Any JavaScript running in that
> preview frame is properly sandboxed on a completely different domain than
> webmaker.org, and the behaviour in the attached video is expected.
> 
> Jon/Pomax - wont-fix?

Good Day Webmaster,

Would it be qualified for bug bounty reward webmaster?
Did you see the video that i attached webmaster?


Respectfully yours,
Garry D. Bacalso

Comment 5

[Mark Goodwin [:mgoodwin]]

Hi Garry,

Execution of script within user content is intentional and by design:

You'll notice that the alerts you popped in your POC are on the mozillathimblelivepreview.net domain - this is a preview domain and is separate from everything on webmaker.org that we might want to protect (session cookies, etc) and so can't be used to launch related-domain attacks. Once content is published, it's also served from a domain unrelated to webmaker.org (for much the same reason).

If you're able to execute script in the context of webmaker.org itself, that would be something of concern.

Thanks for taking the time to get in touch; please keep looking and let us know what else you can find.

Comment 6

[Mark Goodwin [:mgoodwin]]

(In reply to Chris DeCairos (:cade) from comment #2)
> Jon/Pomax - wont-fix?

I'm not Jon or Pomax but I think so

Comment 7

[Mark Goodwin [:mgoodwin]]

My mistake, it's a duplicate.

Comment 8

[Garry D. Bacalso]

Do i have any reward?