bugtraq - ExpressionEngine 2.6 Persistent XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 16 Sep 2013 23:20:20 +0100
From: Richard Clifford <darkmantis@...ershade.org>
To: moderators@...db.org, bugtraq@...urityfocus.com
Subject: ExpressionEngine 2.6 Persistent XSS

Hi,

I'd like to disclose a vulnerability I found in ExpressionEngine 2.6 and 
below.

The issue is when you submit a new entry through Admin -> Content -> 
Publish and you are using the RTE, if you enter HTML into that editor, 
the next page will execute the HTML, which it shouldn’t. The RTE should 
htmlentities all input data that goes in (when you’re not in the 
‘source-view’), thus creating a HTML-Safe preview page.

The payload I used was </title><script>alert(document.domain);</script> 
which got executed on the view_entry.php view (system -> 
expressionengine -> views -> content -> view_entry.php)

The reply that I got from the developers was:

In system/expressionengine/controllers/cp/content_publish.php look at 
line 685:
$r .= ee()->api_channel_fields->apply('replace_tag', array('data' => 
$data));

And replace it with this:
$r .= ee()->api_channel_fields->apply('replace_tag', array('data' => 
htmlentities($data)));

As you can see at: https://support.ellislab.com/bugs/detail/19715

Best Regards,
Richard Clifford.