Summary
Stored cross-site scripting (XSS) is possible through the custom content description. A user with permission to configure custom content can store a script that executes in the browser of a visitor who views the custom content list page.
Details
The custom content description (CustomContents.description) is allowed to contain HTML, but there was no validation to reject scripts at save time, and the output side (CustomContentHelper::description()) echoes the value without escaping.
Impact
Stored XSS affecting visitors of the custom content pages.
Patch
Introduce validationDefault on CustomContentsTable with a containsScript rule for description, and make validationWithTable inherit it so both the create (default) and update (withTable) paths are covered.
Reported via
JVN#26271410 (JPCERT/CC), reported by Gai Tanaka (Mitsui Bussan Secure Directions, Inc.).
Summary
Stored cross-site scripting (XSS) is possible through the custom content description. A user with permission to configure custom content can store a script that executes in the browser of a visitor who views the custom content list page.
Details
The custom content description (
CustomContents.description) is allowed to contain HTML, but there was no validation to reject scripts at save time, and the output side (CustomContentHelper::description()) echoes the value without escaping.Impact
Stored XSS affecting visitors of the custom content pages.
Patch
Introduce
validationDefaultonCustomContentsTablewith acontainsScriptrule fordescription, and makevalidationWithTableinherit it so both the create (default) and update (withTable) paths are covered.Reported via
JVN#26271410 (JPCERT/CC), reported by Gai Tanaka (Mitsui Bussan Secure Directions, Inc.).