RedCloth Cross Site Scripting

2014-12-12 / 2015-04-19
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

I disclosed the following advisory about a XSS vulnerability of RedCloth (Textile library for Ruby). http://co3k.org/blog/redcloth-unfixed-xss-en You shouldn't use RedCloth to parse user inputted contents and output the parsed string (except that you allow your user to write arbitrary JavaScript code on your site) because it contains unfixed XSS vulnerability for 9 years, and it be also disclosed for 2 years. Unfortunately, we may not expect fix the vulnerability by the current developer because he announced that "unable to keep fixing bugs or work on the next major release". If you want to continue to use RedCloth for such contents, you should patch for the problem yourself, consider contributing to RedCloth, or otherwise. PoC === ``` require 'redcloth' print RedCloth.new('["clickme":javascript:alert(%27XSS%27)]', [:filter_html, :filter_styles, :filter_classes, :filter_ids]).to_html # Result: # <p><a href="javascript:alert(%27XSS%27)">clickme</a></p> ``` Timeline ======== * Feb. 24, 2012 : I reported the problem to a developer (by sending e-mail) * Feb. 29, 2012 : A developer discloses the issue in this ticket: http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss * ... * Sep. 24, 2014 : Announced "RedCloth needs new maintainers" to take over RedCloth by a developer: https://github.com/jgarber/redcloth/commit/b24f03db023d1653d60dd33b28e09317cd77c6a0

References:

https://github.com/jgarber/redcloth/commit/b24f03db023d1653d60dd33b28e09317cd77c6a0


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top