26

I'm totally frustrated. I reported this using the procedure mentioned in the FAQ but the confirmation email sent me back to the original form.

There is XSS on every page of Stack Overflow. Injecting ,alert(1), into the path executes when clicking on the mobile version of the site.

Steps to reproduce:

  1. Visit https://stackoverflow.com/%22,alert%281%29,%22.
  2. Click on the mobile link in the footer.

The mobile link is incorrectly escaped for the context the data is in. 

<a onclick='StackExchange.switchMobile("on", "/&quot;,alert(1),&quot;")'>mobile</a>

HTML entities will still break out of the string since the data is inside an attribute resulting in the function being called.

Improve this question
16

2 Answers 2

Reset to default
15

Thanks for reporting this and trying to do the right thing - responsible disclosure via our requested channel - we take security vulnerabilities very seriously.

I don't know what exactly happened and why you have only gotten a confirmation email and nothing else, I will be chasing this up internally and ensure this does not recur.

In other news, as you have noted, the XSS vulnerability has been fixed.

Improve this answer
1
16

My apologies, Gareth - we do take these reports very seriously, and make sure each one is reviewed and responded to by a Real, Live Human™.

Unfortunately, when you emailed us we'd just rolled out a new set of instructions for reporting these, and there was a bit of confusion over how reports should be handled as a result.

(to be specific: we didn't immediately realize that it pointed back at the same "contact" form used for every other "contact us" link)

Again, I sincerely apologize for the confusion; thanks for being persistent!

Improve this answer
9
  • Just rolled out? The page exists for at least two months... what did I miss?
    – Shadow Wizard Is Sad And Angry
    Dec 12, 2013 at 15:26
  • I used the wrong link, @Sha. The new page was put up on the 4th or thereabouts, the same day Gareth contacted us. Note that while the old page has a simple link to "contact us", the new page has a Big Red Button on it. Which... goes to the same place. Such a tease.
    – Shog9
    Dec 12, 2013 at 15:36
  • @ShaWizDowArd - At least two months... aka 6-8 weeks ;)
    – Travis J
    Dec 12, 2013 at 15:38
  • Thanks for fixing but still, nothing new regarding the reporting procedure itself as far as I can see... unless you mean something changed behind the scenes where you handle those reports?
    – Shadow Wizard Is Sad And Angry
    Dec 12, 2013 at 15:41
  • That's because there isn't anything new regarding the actual procedures: it's still "1) verify report (if possible), 2) forward to the dev team". We don't do automated responses or priority queues or anything else like that; this was simply a bit of confusion caused by poor communication internally - even though the new page looks like it does something different, it was (and is) supposed to be handled in exactly the same manner as the old page. @Sha
    – Shog9
    Dec 12, 2013 at 15:43
  • Fair enough. So you mean the OP here got response saying "Please report this using [link to form here]"?
    – Shadow Wizard Is Sad And Angry
    Dec 12, 2013 at 15:46
  • Correct, @Sha. Which of course, took him right back to where he started.
    – Shog9
    Dec 12, 2013 at 15:46
  • Oh, endless loop. Wonderful! ;)
    – Shadow Wizard Is Sad And Angry
    Dec 12, 2013 at 15:46
  • 3
    It's all good until your stack overflows.
    – Shog9
    Dec 12, 2013 at 15:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .