Exponentcms Exponent CMS → User issues

Comments and changes to this ticket

• You flagged this item as spam.
  

  Mayuresh Dani November 4th, 2014 @ 03:19 PM

  Also a logged-in user can launch a similar attack simply by entering malicious java script into the "First Name" and "Last Name" fields on http://localhost/exponent/users/edituser. If you enter a simple script tag such as - and you save it, you get the screen shot that I have attached.

  Thanks,
  Mayuresh and Narendra

  • ExponentUser2.PNG 35.4 KB
• 

  expNinja November 5th, 2014 @ 02:12 PM

  (from [f8e878bbe4619c2bcfe4b35ed2fc795e9e384f71]) Better job of scrubbing all params coming in either by sef or query url [#1230] https://github.com/exponentcms/exponent-cms/commit/f8e878bbe4619c2b...

• 

  expNinja November 5th, 2014 @ 02:37 PM

  (from [c9a5dc3008834c01f9619215ddeb7ccf1aeefa9a]) More universal/efficient fix for scrubbing parameters [#1230] https://github.com/exponentcms/exponent-cms/commit/c9a5dc3008834c01...

• 

  expNinja November 5th, 2014 @ 06:28 PM

  (from [082ab6e21a47940927407cc0bdc10875f5deb3fa]) Better job of scrubbing all params coming in either by sef or query url #1230 https://github.com/exponentcms/exponent-cms/commit/082ab6e21a479409...

• 

  expNinja November 5th, 2014 @ 06:28 PM

  (from [e18e4d534f5b704954888a8dc9a6a0373fd54247]) More universal/efficient fix for scrubbing parameters #1230 https://github.com/exponentcms/exponent-cms/commit/e18e4d534f5b7049...

• 

  dleffler November 5th, 2014 @ 06:33 PM

  • State changed from “new” to “resolved”
  • Assigned user changed from “expNinja” to “dleffler”

  This issue has been addressed in the development code (v2.3.2 pre-release) and a patch now exists for v2.1.4, v2.2.3, and v2.3.1

• 

  dleffler November 5th, 2014 @ 07:42 PM

  • State changed from “resolved” to “open”

  Reopened as we scrub too much out of the input

• 

  dleffler November 6th, 2014 @ 06:39 PM

  • State changed from “open” to “resolved”

  Correct fix now re-introduced in the patches and working code.

• You flagged this item as spam.
  

  Mayuresh Dani November 10th, 2014 @ 12:30 PM

  Any updates about the vulnerability in user profiles?

• 

  dleffler November 10th, 2014 @ 01:05 PM

  • Tag set to “security”

  ALL form input is scrubbed before passing into the system...in addition to standard processing, specifically 'script' tags are removed.

• You flagged this item as spam.
  

  Mayuresh Dani November 11th, 2014 @ 11:06 AM

  Okay. Would have really appreciated if you guys could have atleast mentioned us for reporting these vulnerabilities when releasing patches though. :-)

• 

  dleffler November 12th, 2014 @ 01:15 PM

  • State changed from “resolved” to “open”
  • Milestone set to “User issues”

• You flagged this item as spam.
  

  Mayuresh Dani November 13th, 2014 @ 06:59 AM

  Thanks for mentioning us. :-)

• 

  dleffler November 13th, 2014 @ 04:10 PM

  • State changed from “open” to “resolved”

  Ok, the data corruption (adding rn's) was a magic quotes problem