XSS vulnerability in Gannet

geneontology / amigo

AmiGO is the public interface for the Gene Ontology.

http://amigo.geneontology.org

BSD 3-Clause "New" or "Revised" License

29 stars 17 forks source link

XSS vulnerability in Gannet #576

Closed kltm closed 3 years ago

kltm commented 5 years ago

It is currently possible to inject disrupting code into Gannet parameters that could be used to create an XSS attack for users on bad links. For example, the following URL illustrates this:

~~https://amigo-staging.geneontology.io/gannet?mirror=amigo_2_local_default&query=%3c%2ftextarea%3e%3cscRipt%3enetsparker(0x0067DA)%3c%2fscRipt%3e~~

kltm commented 3 years ago

This looks to be cleared now.

kltm commented 3 years ago

New problematic example:

[x] http://amigo-exp.geneontology.io/gannet?query=q%3D*%3A*%0D%0Afq%3Ddocument_category%3Cscript%3Ealert(document.domain)%3C/script%3E%3E%3Aannotation%0D%0Afq%3Dsource%3A%22TAIR%22%0D%0Afq%3Devidence_type%3A%22IEA%22%0D%0A&mirror=amigo_2_local_default

kltm commented 3 years ago

I think I got it.