[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20200323100605.27fd2c46@computer>
Date: Mon, 23 Mar 2020 10:06:05 +0100
From: Hanno Böck <hanno@...eck.de>
To:
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Serendipity XSS via update notification (minor, exploitable by s9y
developers)
I reported an XSS in Serendipity that is now fixed in version 2.3.3. It
is only exploitable by either the developers of serendipity or someone
compromising Github, so I consider this very minor.
My bug report to s9y [1]:
The version number shown in the update notification window is not
escaped. This means it can contain javascript payload and thus allow
XSS.
The version information is fetched from a Github URL, which means this
is an XSS vulnerability that can only be exploited by the serendipity
developers or github itself. So this makes it rather low severity.
Still I'd consider safety against the developers or potentially
compromised developer accounts desirable where possible, and this seems
easy to fix.
PoC: Change the $updateURL variable in
include/functions_installer.inc.php in the function
serendipity_getCurrentVersion to one you control and add something like:
stable:9.<img src=x onerror=alert(1)><x
beta:9.<img src=x onerror=alert(2)><x
(s9y adds a </span> somewhere at the end for reasons I don't
understand, by adding the bogus <x I avoid that disturbing my payload.)
[1] https://github.com/s9y/Serendipity/issues/674
--
Hanno Böck
https://hboeck.de/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
