XSS: It's possible to run javascript code on guest pc

notandy / ympd

Standalone MPD Web GUI written in C, utilizing Websockets and Bootstrap/JS

http://www.ympd.org

GNU General Public License v2.0

523 stars 144 forks source link

XSS: It's possible to run javascript code on guest pc #34

Closed edne closed 10 years ago

edne commented 10 years ago

File names are not parsed, with a non-root access on the server you can run code on guests cp file.mp3 "file <img src=\"qwertyu\" onerror=\"alert('Hacko IO?')\" style=\"visibility:hidden\">.mp3"

notandy commented 10 years ago

Hi,

Yeah, XSS is possible, for example in ID3 Tags... but what could a potential attacker gain? There are no passwords stored on the client, the only cookie that's used is for browser notification setting. Since ympd is about being really lightweight and easy, I don't rate this bug critical and would refrain from sanitizing metadata (Manipulating strings in C is really pain the ass).