Stored XSS in TinyMCE editor

[Hugh Davenport]

Reported by two independent researchers in different locations.

How to reproduce:
- Go to a page with a TinyMCE editor (such as /artefact/internal/ -> Introduction)
- Click the TinyMCE "HTML" button
- Enter payload of something like "<img src=x onmouseover=alert(1)>"
- Save page
- Reload, hover over broken image, notice the alert

The XSS is stored only for the editing part of the TinyMCE editor. I couldn't quickly find any location where
it was not escaped in the view section (which is blocktype dependant, the above example would be the
profileinfo blocktype from artefact/internal).

The fix is to escape the value sent to tinymce in lib/form/elements/wysiwyg.php, patch forthcoming.

The other location reported was in a new page, the "Page description" input. The same patch fixes this.

[Hugh Davenport (hugh-davenport)]

https://reviews.mahara.org/2044

[Ahmad Ashraff (slumber1412)]

Hey Hugh,
Thanks for that!

On Tue, Mar 12, 2013 at 5:15 AM, Hugh Davenport
<email address hidden>wrote:

> ** CVE added: http://www.cve.mitre.org/cgi-
> bin/cvename.cgi?name=2013-1426
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1153423
>
> Title:
> Stored XSS in TinyMCE editor
>
> Status in Mahara ePortfolio:
> Confirmed
>
> Bug description:
> Reported by two independent researchers in different locations.
>
> How to reproduce:
> - Go to a page with a TinyMCE editor (such as /artefact/internal/ ->
> Introduction)
> - Click the TinyMCE "HTML" button
> - Enter payload of something like "<img src=x onmouseover=alert(1)>"
> - Save page
> - Reload, hover over broken image, notice the alert
>
> The XSS is stored only for the editing part of the TinyMCE editor. I
> couldn't quickly find any location where
> it was not escaped in the view section (which is blocktype dependant,
> the above example would be the
> profileinfo blocktype from artefact/internal).
>
> The fix is to escape the value sent to tinymce in
> lib/form/elements/wysiwyg.php, patch forthcoming.
>
> The other location reported was in a new page, the "Page description"
> input. The same patch fixes this.
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/mahara/+bug/1153423/+subscriptions
>

--
*Thanks,
@yappare
*

[Aaron Wells (u-aaronw)]

fix for 1.5: https://reviews.mahara.org/2064

[Aaron Wells (u-aaronw)]

fix for 1.6: https://reviews.mahara.org/2065