mainSavannah Administration - Support: sr #106475, Cross-site scripting using...

 
 

sr #106475: Cross-site scripting using feedback variable

Submitter:  Daniel Kahn Gillmor <dkg>
Submitted:  Fri 22 Aug 2008 05:40:58 PM UTC
Votes: 15
 
Category:  None Priority:  5 - Normal
Severity:  6 - Security Status:  None
Privacy:  Public Assigned to:  None
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 13 Feb 2010 10:53:35 PM UTC, comment #3: 

The XSS does not seem to work any more.  Still, it's not comforting that an attacker can place arbitrary text in an apparently trusted part of the Savannah UI.  Example.

Matt McCutchen <hashproduct>
Fri 22 Aug 2008 05:46:01 PM UTC, comment #2: 

OK, if you follow the link in comment # 1, it should take you to a page where mousing over the floating GNU in the green feedback box will trigger a javascript alert that says "monkeys!".

It doesn't take much to go from there to javascript that does arbitrarily complicated things as the logged-in user.

I consider this a fairly severe security concern.

Daniel Kahn Gillmor <dkg>
Fri 22 Aug 2008 05:42:10 PM UTC, comment #1: 
Daniel Kahn Gillmor <dkg>
Fri 22 Aug 2008 05:40:58 PM UTC, original submission:  

Hey folks.

It looks to me like i can coax an XSS attack out of the savannah infrastructure by injecting arbitrary html (including attributes which execute javascript) in the "feedback" variable.

[/my/admin/?feedback=monkeytown.%20%3Cimg%20onmouseover=%22alert(%27monkeys!%27);%22%20src=%20%2Fimages%2FSavannah.theme%2Ffloating.png%20%20%2F%3E#6917874799045293895 hover over the gnu that appears when you follow this link for an example] (i'm not sure if it will work right because there's no Preview, but i'll cook something else up in the comments if this attack doesn't work)

Daniel Kahn Gillmor <dkg>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by hashproduct (Posted a comment)
  • -email is unavailable- added by hashproduct
  • -email is unavailable- added by dkg (Voted in favor of this item)
  • -email is unavailable- added by dkg (Submitted the item)
  •  

    There are 15 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-02-13 hashproduct Carbon-Copy- Added hashproduct
    2008-08-25 dkg Carbon-Copy- Added dkg

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code