26

I'm totally frustrated. I reported this using the procedure mentioned in the FAQ but the confirmation email sent me back to the original form.

There is XSS on every page of Stack Overflow. Injecting ,alert(1), into the path executes when clicking on the mobile version of the site.

Steps to reproduce:

  1. Visit https://stackoverflow.com/%22,alert%281%29,%22.
  2. Click on the mobile link in the footer.

The mobile link is incorrectly escaped for the context the data is in. 

<a onclick='StackExchange.switchMobile("on", "/&quot;,alert(1),&quot;")'>mobile</a>

HTML entities will still break out of the string since the data is inside an attribute resulting in the function being called.

Improve this question
16
  • I assume you sent the report here first? What you mean "confirmation email sent me back to the original form"? When did you send the report and what exact reply you got?
    – Shadow Wizard
    Commented Dec 12, 2013 at 10:06
  • I used the contact form stackoverflow.com/contact as described as a way to report vulnerabilities. The response I got back directed me back to the same form.
    – Gareth Heyes ล้้้้้้้้้้้้้้้้
    Commented Dec 12, 2013 at 10:08
  • Are you sure it wasn't automatic response just to confirm your report has been sent? When did you send it? I find it really hard to believe the team will ignore such report.
    – Shadow Wizard
    Commented Dec 12, 2013 at 10:09
  • Is it coincidence that I'm currently reading the XSS wikipedia article when this poped up?
    – Johannes Kuhn
    Commented Dec 12, 2013 at 10:10
  • @JohannesKuhn Conspiracy!
    – 3ventic
    Commented Dec 12, 2013 at 10:11
  • 1
    @JohannesKuhn hurry up, now that you know XSS you can steal all the cookies! ;-)
    – Shadow Wizard
    Commented Dec 12, 2013 at 10:14
  • 1
    I would generally just send security issues like this directly too [email protected]; ignore whatever the contact form says.
    – Jeremy
    Commented Dec 12, 2013 at 10:15
  • 1
    mmmmmmm cookies
    – Gareth Heyes ล้้้้้้้้้้้้้้้้
    Commented Dec 12, 2013 at 10:17
  • Good catch. I'd checked that link before but didn't realize the consequences of the escaping they'd used.
    – Jeremy
    Commented Dec 12, 2013 at 10:18
  • Did you not see a message like this after submitting the contact form?
    – Jeremy
    Commented Dec 12, 2013 at 10:20
  • Yes and my email response linked me back to the same contact form.
    – Gareth Heyes ล้้้้้้้้้้้้้้้้
    Commented Dec 12, 2013 at 10:21
  • 4
    Would you mind going into further detail about what the confirmation email says? That may be a UX issue worth discussing on its own.
    – Jeremy
    Commented Dec 12, 2013 at 10:24
  • @GarethHeyes I don't understand why you refuse to tell us when did you send the report. If it was only short while ago, just give them some time.
    – Shadow Wizard
    Commented Dec 12, 2013 at 10:25
  • I reported it last week.
    – Gareth Heyes ล้้้้้้้้้้้้้้้้
    Commented Dec 12, 2013 at 10:27
  • @JeremyBanks I'll send you the text when I get home tonight. I don't have the email to hand right now.
    – Gareth Heyes ล้้้้้้้้้้้้้้้้
    Commented Dec 12, 2013 at 10:28

2 Answers 2

Reset to default
15

Thanks for reporting this and trying to do the right thing - responsible disclosure via our requested channel - we take security vulnerabilities very seriously.

I don't know what exactly happened and why you have only gotten a confirmation email and nothing else, I will be chasing this up internally and ensure this does not recur.

In other news, as you have noted, the XSS vulnerability has been fixed.

Improve this answer
1
15

My apologies, Gareth - we do take these reports very seriously, and make sure each one is reviewed and responded to by a Real, Live Human™.

Unfortunately, when you emailed us we'd just rolled out a new set of instructions for reporting these, and there was a bit of confusion over how reports should be handled as a result.

(to be specific: we didn't immediately realize that it pointed back at the same "contact" form used for every other "contact us" link)

Again, I sincerely apologize for the confusion; thanks for being persistent!

Improve this answer
9
  • Just rolled out? The page exists for at least two months... what did I miss?
    – Shadow Wizard
    Commented Dec 12, 2013 at 15:26
  • I used the wrong link, @Sha. The new page was put up on the 4th or thereabouts, the same day Gareth contacted us. Note that while the old page has a simple link to "contact us", the new page has a Big Red Button on it. Which... goes to the same place. Such a tease.
    – Shog9
    Commented Dec 12, 2013 at 15:36
  • @ShaWizDowArd - At least two months... aka 6-8 weeks ;)
    – Travis J
    Commented Dec 12, 2013 at 15:38
  • Thanks for fixing but still, nothing new regarding the reporting procedure itself as far as I can see... unless you mean something changed behind the scenes where you handle those reports?
    – Shadow Wizard
    Commented Dec 12, 2013 at 15:41
  • That's because there isn't anything new regarding the actual procedures: it's still "1) verify report (if possible), 2) forward to the dev team". We don't do automated responses or priority queues or anything else like that; this was simply a bit of confusion caused by poor communication internally - even though the new page looks like it does something different, it was (and is) supposed to be handled in exactly the same manner as the old page. @Sha
    – Shog9
    Commented Dec 12, 2013 at 15:43
  • Fair enough. So you mean the OP here got response saying "Please report this using [link to form here]"?
    – Shadow Wizard
    Commented Dec 12, 2013 at 15:46
  • Correct, @Sha. Which of course, took him right back to where he started.
    – Shog9
    Commented Dec 12, 2013 at 15:46
  • Oh, endless loop. Wonderful! ;)
    – Shadow Wizard
    Commented Dec 12, 2013 at 15:46
  • 3
    It's all good until your stack overflows.
    – Shog9
    Commented Dec 12, 2013 at 15:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .