bugZoneCheck - Bugs: bug #29967, XSS threats


bug #29967: XSS threats

Submitted by:  None
Submitted on:  Wed 26 May 2010 12:30:50 PM UTC  
Category:  input Severity:  Critical
Priority:  9 - Immediate Item Group:  Crash/Error
Status:  Fixed Privacy:  Public
Assigned to:  Fabien CHABANNE <chabannf> Open/Closed:  Closed

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Wed 26 May 2010 03:27:30 PM UTC, comment #3: 
Fabien CHABANNE <chabannf>
Project MemberIn charge of this item.
Wed 26 May 2010 02:12:24 PM UTC, comment #2: 

The right solution is probably to wrap every output with escapeHTML.


Stephane Bortzmeyer <bortzmeyer>
Project Administrator
Wed 26 May 2010 01:57:07 PM UTC, comment #1: 

The original exploit uses the 'ns' parameter but the others are vulnerable as well (tested with 'zone'). No escape is done before writing the HTML.

Stephane Bortzmeyer <bortzmeyer>
Project Administrator
Wed 26 May 2010 12:30:50 PM UTC, original submission:  





Entered datas are not correctly escaped and fails against XSS exploits protection.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by chabannf (Posted a comment)
  • -email is unavailable- added by bortzmeyer (Posted a comment)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-06-22 chabannf Open/ClosedOpen => Closed
    2010-05-26 chabannf StatusConfirmed => Fixed
    2010-05-26 bortzmeyer SeverityHigh => Critical
        Priority5 - Normal => 9 - Immediate
        Item GroupAction request => Crash/Error
        StatusNone => Confirmed
        Assigned toNone => chabannf

    Back to the top

    Powered by Savane 3.7