Project

General

Profile

Bug #11859

CVE-2015-5282 - Parameter hide/show checkbox allows stored XSS during textbox change

Added by Dominic Cleal over 7 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Security
Target version:
Difficulty:
Triaged:
Bugzilla link:
Fixed in Releases:
Found in Releases:
Red Hat JIRA:

Description

We allow storage of key/value parameters globally or assigned to various objects, and using a tickbox in the UI the values can be hidden to mask them from casual viewing. The tickbox that hides/shows the value fails to handle HTML properly and so is vulnerable to an XSS issue where HTML can be stored in a parameter, and executed by another user if they later tick the hide/show box.

An example on the global parameters form is:

"><script>alert("hi")</script><b c="

Store this in a parameter value, reload the page and click the "Hidden value" checkbox and the JavaScript will execute. The reverse is probably possible too.

Associated revisions

Revision 4f3555b2 (diff)
Added by Shlomi Zadok over 7 years ago

Fixes #11859 - handle HTML in parameters safely when hiding values (CVE-2015-5282)

History

#1 Updated by The Foreman Bot over 7 years ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman/pull/2736 added
  • Pull request deleted ()

#2 Updated by Dominic Cleal over 7 years ago

  • Subject changed from Parameter hide/show checkbox allows XSS during textbox change to CVE-2015-5282 - Parameter hide/show checkbox allows stored XSS during textbox change
  • Description updated (diff)

#3 Updated by Dominic Cleal over 7 years ago

  • Assignee set to Shlomi Zadok

#4 Updated by Shlomi Zadok over 7 years ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100

#5 Updated by Bryan Kearney over 7 years ago

  • Bugzilla link set to 1268995

Also available in: Atom PDF