Several vectors for JS injection #579

New issue

Closed

opened 2012-02-21 12:40:29 +00:00 by rlx · 5 comments

rlx commented

2012-02-21 12:40:29 +00:00

Owner

JS injection via username: Greetings from user <script>alert('0wned!')</script> ...

JS injection via username: Greetings from user `<script>alert('0wned!')</script>` ...

rlx added the

general

label 2012-02-21 12:40:29 +00:00

rlx added this to the 12.03 milestone 2012-02-21 12:40:29 +00:00

0x2620 was assigned by rlx

2012-02-21 12:40:29 +00:00

rlx added the

critical

defect

labels 2012-02-21 12:40:29 +00:00

rlx commented

2012-02-21 12:47:19 +00:00

Author

Owner

Strangely, this user does not show up in the users list.

But by adding annotations, the user can make alerts pop up.

Strangely, this user does not show up in the users list. But by adding annotations, the user can make alerts pop up.

rlx commented

2012-02-21 12:56:16 +00:00

Author

Owner

List names (entered in folder) and list descriptions (entered in dialog) execute JS, too.

rlx commented

2012-02-21 13:13:45 +00:00

Author

Owner

In Manage Places/Events, if you enter as name or alternative name, the map/calendar will execute this as JS.

Saving seems to be fixed, so dialogs will go after reload.

In Manage Places/Events, if you enter <script>alert('JS injection')</script> as name or alternative name, the map/calendar will execute this as JS. Saving seems to be fixed, so dialogs will go after reload.

rlx changed title from ~~JS injection via username~~ to Several vectors for JS injection

2012-02-21 13:13:45 +00:00

rlx commented

2012-02-21 13:15:23 +00:00

Author

Owner

Another one is:

pandora.api.addAnnotation({item: 'A', layer: 'descriptions', 'in': 23, out: '42', value: '<script>alert("description")</script>'}, function(r) { Ox.print(r.data); })

Another one is: ` pandora.api.addAnnotation({item: 'A', layer: 'descriptions', 'in': 23, out: '42', value: '<script>alert("description")</script>'}, function(r) { Ox.print(r.data); }) `

rlx commented

2012-02-21 14:15:12 +00:00

Author

Owner

By whatever means we fix this, the goal should be that the surface of the fix, i.e. the amount of reasoning needed to verify it's correct, is as small as possible.