Bug 76631 – net-www/bugzilla: XSS Vulnerabilities

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Luke Macken (RETIRED) 2005-01-04 06:22:19 UTC]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Build Identifier: 

If bugzilla.mozilla.org runs into in internal error it dumps out a notice to 
send the requested url to an admin. This is done using a line of javascript:

document.write("<p>URL: " + document.location + "</p>")

Since Internet Explorer and some other browsers do not force proper URL 
encoding you can easily force an error and inject arbitrary javascript code:

https://bugzilla.mozilla.org/attachment.cgi?
id=&action=force_internal_error<script>alert(document.cookie)</script>

Bugzilla does not understand the action parameter, raises an internal error and 
this leads to an XSS. This can be used to steal the session cookie or fake 
content on the website.

Mozilla/Firefox users seem to be not vulnerable since the browser automaticly 
converts < into %3C before sending the request.


Reproducible: Always
Steps to Reproduce:
Just open the link in Internet Explorer or create a page like this:

<script language="javascript" type="text/javascript"> 
location = 'https://bugzilla.mozilla.org/attachment.cgi?
id=&action=force_internal_error<script>alert(document.cookie)<\/script>'
</script>

--

This is CAN-2004-1061

[Comment 1 Sune Kloppenborg Jeppesen (RETIRED) 2005-01-04 10:15:07 UTC]

web-apps please verify and advise.

[Comment 2 Thierry Carrez (RETIRED) 2005-01-11 03:02:59 UTC]

I can confirm : shitty browsers are vulnerable to this.
reproduced on www-apps/bugzilla-2.18.0_rc2

web-apps: Please bump Bugzilla with the following patch.

[Comment 3 Thierry Carrez (RETIRED) 2005-01-11 03:03:31 UTC]

Created attachment 48180 [details, diff]
CAN-2004-1061.diff

Patch from Bugzilla bug

[Comment 4 Stuart Herbert (RETIRED) 2005-01-11 14:43:15 UTC]

I'm out of town, and can't pick this up until the weekend at the earliest, sorry.  If anyone else wants to pick this up before then, be my guest.

Best regards,
Stu

[Comment 5 Thierry Carrez (RETIRED) 2005-01-15 13:09:47 UTC]

Stuart: the weekend will be fine :)

[Comment 6 Stuart Herbert (RETIRED) 2005-01-19 05:29:27 UTC]

Committed to Portage.

Best regards,
Stu

[Comment 7 Sune Kloppenborg Jeppesen (RETIRED) 2005-01-19 05:49:13 UTC]

Thx Stuart.

ppc please test and mark bugzilla-2.18.0_rc4 stable.

[Comment 8 Thierry Carrez (RETIRED) 2005-01-21 02:34:16 UTC]

GLSA vote : I wouldn't issue an advisory about it since you have to still use Internet Explorer to be vulnerable. so NO

[Comment 9 Stuart Herbert (RETIRED) 2005-01-21 03:21:28 UTC]

a) most people use Internet Explorer
b) a vulnerable version was stable on at least one arch (ppc)
c) if we fix a security hole, we should put out an advisory.  No exceptions ;-)

Best regards,
Stu

[Comment 10 Sune Kloppenborg Jeppesen (RETIRED) 2005-01-21 03:32:56 UTC]

Stuart we release according to our Vulnerability Policy http://www.gentoo.org/security/en/vulnerability-policy.xml

For vulnerabilities rated B4 a vote is normally called on wether to issue a GLSA.

[Comment 11 Luca Barbato 2005-01-21 14:35:32 UTC]

btw now ppc is safe

[Comment 12 Thierry Carrez (RETIRED) 2005-01-21 14:42:30 UTC]

Security, please vote

[Comment 13 Sune Kloppenborg Jeppesen (RETIRED) 2005-01-23 04:48:51 UTC]

I tend to vote for no GLSA on this one. Security please cast your vote.

[Comment 14 Jochen Maes (RETIRED) 2005-01-26 12:46:17 UTC]

i agree with jaervosz

[Comment 15 Thierry Carrez (RETIRED) 2005-01-26 12:50:37 UTC]

And I agree with SeJo. Stupid bugs requiring stupid browsers and a stupid user should not be worth a GLSA.