bugZoneCheck - Bugs: bug #29967, XSS threats


bug #29967: XSS threats

Submitter:  None
Submitted:  Wed 26 May 2010 12:30:50 PM UTC
Category:  input Severity:  Critical
Priority:  9 - Immediate Item Group:  Crash/Error
Status:  Fixed Privacy:  Public
Assigned to:  chabannf Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup

Wed 26 May 2010 03:27:30 PM UTC, comment #3: 
Fabien CHABANNE <chabannf>
Group Member
Wed 26 May 2010 02:12:24 PM UTC, comment #2: 

The right solution is probably to wrap every output with escapeHTML.


Stephane Bortzmeyer <bortzmeyer>
Group administrator
Wed 26 May 2010 01:57:07 PM UTC, comment #1: 

The original exploit uses the 'ns' parameter but the others are vulnerable as well (tested with 'zone'). No escape is done before writing the HTML.

Stephane Bortzmeyer <bortzmeyer>
Group administrator
Wed 26 May 2010 12:30:50 PM UTC, original submission:  





Entered datas are not correctly escaped and fails against XSS exploits protection.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by chabannf (Posted a comment)
  • -email is unavailable- added by bortzmeyer (Posted a comment)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-06-22 chabannf Open/ClosedOpen Closed
    2010-05-26 chabannf StatusConfirmed Fixed
    2010-05-26 bortzmeyer SeverityHigh Critical
        Priority5 - Normal 9 - Immediate
        Item GroupAction request Crash/Error
        StatusNone Confirmed
        Assigned toNone chabannf

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code