search

modxbot / migrate

A testground for migrating issues and other such fun
0 stars 0 forks source link

[XSS] connectors reflect action parameter value with HTML tags #10182

Closed opengeek closed 11 years ago

opengeek commented 11 years ago

opengeek created Redmine issue ID 10182

modConnectorResponse::outputContent() is reflecting an improperly sanitized value of the action parameter via the processor_err_nf lexicon. This lexicon accepts a target replacement value, which is currently being passed the raw action parameter (with only sub-directory traversal being prevented).

The only caveat is that an attacker would require the HTTP_MODAUTH value to be used for a valid user session.

opengeek commented 11 years ago

opengeek submitted:

To reproduce:

http://localhost/revo/connectors/index.php?start=0&limit=10&action=security/user/getRecentlyEditedResources%3Csvg%20onload=alert('XSS')%3E&user=1&HTTP_MODAUTH=