[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] Serendipity XSS via update notification (minor, exploitable by s9y developers)
From:       Hanno =?iso-8859-1?q?B=F6ck?= <hanno () hboeck ! de>
Date:       2020-03-23 9:06:05
Message-ID: 20200323100605.27fd2c46 () computer
[Download RAW message or body]

I reported an XSS in Serendipity that is now fixed in version 2.3.3. It
is only exploitable by either the developers of serendipity or someone
compromising Github, so I consider this very minor.

My bug report to s9y [1]:

The version number shown in the update notification window is not
escaped. This means it can contain javascript payload and thus allow
XSS.

The version information is fetched from a Github URL, which means this
is an XSS vulnerability that can only be exploited by the serendipity
developers or github itself. So this makes it rather low severity.

Still I'd consider safety against the developers or potentially
compromised developer accounts desirable where possible, and this seems
easy to fix.

PoC: Change the $updateURL variable in
include/functions_installer.inc.php in the function
serendipity_getCurrentVersion to one you control and add something like:

stable:9.<img src=x onerror=alert(1)><x
beta:9.<img src=x onerror=alert(2)><x

(s9y adds a </span> somewhere at the end for reasons I don't
understand, by adding the bogus <x I avoid that disturbing my payload.)

[1] https://github.com/s9y/Serendipity/issues/674
-- 
Hanno Böck
https://hboeck.de/
[prev in list] [next in list] [prev in thread] [next in thread]