search

glFusion / glfusion

glFusion CMS - Advanced Content Management with Style
https://www.glfusion.org
GNU General Public License v2.0
14 stars 15 forks source link

XSS-Reflected vulnerability #488

Closed nu11secur1ty closed 2 years ago

nu11secur1ty commented 2 years ago

Hello dear friends, please fix it: https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/glfusion/XSS-Reflected/PoC/XSS-Reflected-for-system-reported-on-CVE-2021-44937.gif KR

mark0263 commented 2 years ago

I see where the title passed is display, but the links are properly sanitized and always links back to the actual item being commented on. I will remove the parsing of the title all together as it is not really used any longer, but I do not see where there is an actually XSS vulnerability - can you provide any additional details since the link to this text will always be back to the article.

mark0263 commented 2 years ago

Force the title to be the same as the item being commented on - fixed in both dev and LTS. This completely removes the ability to pass or alter the 'title' attribute.

As far as I can tell - the XSS URL in the video sent was properly stripped so the link to the title text was correctly using the link to the article (or item being commented on). This appears to have only been cosmetic without an actual XSS issue.