full-disclosure

Open Source and information security mailing list archives

Message-ID: <CAAHKNRFYRHXviy0SC3DnABEE0LfM4MmjG6XaEvdSpz1gxG51iw@mail.gmail.com>
Date: Thu, 22 Jun 2017 15:49:49 +0000
From: Caleb Cushing <xenoterracide@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Vaadin Javascript Injection

first time poster, so I'm not sure if this is the best venue, format, etc.

https://github.com/vaadin/framework/issues/8731

using vaadin 7.7.6
using example
https://vaadin.com/docs/-/part/framework/components/components-combobox.html
 but with malicious text that assumes humans are adding the planet names
via a form.

// List of planets
List<Planet> planets = new ArrayList<>();
planets.add(new Planet(1, "<iframe width="560" height="315"
src="https://www.youtube.com/embed/dQw4w9WgXcQ?autoplay=1&rel=0"
frameborder="0" allowfullscreen></iframe>"));

ComboBox<Planet> select =
    new ComboBox<>("Select or Add a Planet");
select.setItems(planets);
select.setDescription(""); // doesn't do anything

the combobox will render this as <div
onmouseenter="alert('hello')">:Goog</div> but the description (tooltip)
will actually render the html and thus allow you to exploit the system. If
you encode it first converting < to &lt; then the list itself will have the
ugly &lt; which isn't what you want to show for <E> Corp (Mr. Robot :D).
The best way to fix this issue is to have an ItemDescriptionGenerator to
allow a separate tooltip to be generated from the contents of the list.

I've determined this bug is still relevant in 7.7.9.

Outside of reminding them, I'm trying to determine the best next steps,
whether this should get a CVE, how to go about doing that in spite of
upstream ignoring it, whether this is even the appropriate venue to talk
about such things. Maybe this shouldn't even be considered a vulnerability,
feedback welcome.
-- 
Caleb Cushing

http://xenoterracide.com

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives