bugtraq - Mephisto blog is vulnerable to XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <9DF7972C-0AAE-4E75-8882-5CB8B1DB73FF@haqu.net>
Date: Sun, 25 Mar 2007 12:52:39 +0700
From: Sergey Tikhonov <st@...u.net>
To: bugtraq@...urityfocus.com
Subject: Mephisto blog is vulnerable to XSS

Hello everyone!

Current bleeding-edge version of Mephisto blog is vulnerable to XSS.  
Comment's author name accept javascript code. If admin approves/ 
rejects comments manually, he have to load all unapproved comments,  
so it's possible to fetch his session id.

Example

Add new comment with the following author name: <script>alert 
(document.cookie)</script>
Then from admin's overview section check this comment - you'll see  
message with cookie.
If you manually approve your comments, check list of pending comments.

How to fix it

patch for <approot>/app/helpers/application_helper.rb :

5c5
<     return comment.author if comment.author_url.blank?
---
 >     return h(comment.author) if comment.author_url.blank?

Best wishes!
Sergey Tikhonov