Project

General

Profile

Actions

Defect #19117

closed

XSS Vulnerability in Flash rendering

Added by Jan from Planio www.plan.io about 9 years ago. Updated over 8 years ago.

Status:
Closed
Priority:
High
Assignee:
-
Category:
Security
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Resolution:
Fixed
Affected version:

Description

Summary

There one one confirmed and several potential XSS vulnerabilities in
Redmine's flash rendering.

Description

When rendering flash messages, Redmine unconditionally marks the
rendered messages as html_safe. This leads to all html special
characters in the flash message to be rendered as HTML unless they are
manually escaped beforehand.

In several places in Redmine, the message is not sufficiently escaped
and allows the rendering of raw, user-supplied values.

Example exploit:

Given a user with the following string configured as the email address
(which is accepted by the mail validations):

"><script>alert('Vulnerable!')</script>"

When that user sends himself a test mail using the admin/test_mail
action, the configured email is pushed unescaped in the flash message,
resulting in the included javascript to be executed.

This can be used in a targeted attack as a reflected XSS to perform
actions as an administrator.

The attached patch also fixes other places where potentially unsafe
information is passed in a flash message, including an issue similar to
the one described above concerning mail registration.

This vulnerability is in Redmine since at least 2.3, possibly much
longer. It is advised to backport the patch to all supported versions of
Redmine and to release updated versions.

Credits

This issue was discovered by Holger Just of Planio.

Solution

Attach the patch against current Redmine trunk (redmine:r14014) attached to this
mail.


Files

Actions

Also available in: Atom PDF