I'm totally frustrated. I reported this using the procedure mentioned in the FAQ but the confirmation email sent me back to the original form.

There is XSS on every page of Stack Overflow. Injecting ,alert(1), into the path executes when clicking on the mobile version of the site.

Steps to reproduce:

  1. Visit https://stackoverflow.com/%22,alert%281%29,%22.
  2. Click on the mobile link in the footer.

The mobile link is incorrectly escaped for the context the data is in.

<a onclick='StackExchange.switchMobile("on", "/&quot;,alert(1),&quot;")'>mobile</a>

HTML entities will still break out of the string since the data is inside an attribute resulting in the function being called.

  • I assume you sent the report here first? What you mean "confirmation email sent me back to the original form"? When did you send the report and what exact reply you got? – Shadow Dec 12 '13 at 10:06
  • I used the contact form stackoverflow.com/contact as described as a way to report vulnerabilities. The response I got back directed me back to the same form. – Gareth Heyes ล้้้้้้้้้้้้้้้้ Dec 12 '13 at 10:08
  • Are you sure it wasn't automatic response just to confirm your report has been sent? When did you send it? I find it really hard to believe the team will ignore such report. – Shadow Dec 12 '13 at 10:09
  • Is it coincidence that I'm currently reading the XSS wikipedia article when this poped up? – Johannes Kuhn Dec 12 '13 at 10:10
  • @JohannesKuhn Conspiracy! – 3ventic Dec 12 '13 at 10:11
  • 1
    @JohannesKuhn hurry up, now that you know XSS you can steal all the cookies! ;-) – Shadow Dec 12 '13 at 10:14
  • 1
    I would generally just send security issues like this directly too team@stackexchange.com; ignore whatever the contact form says. – Jeremy Banks Dec 12 '13 at 10:15
  • 1
    mmmmmmm cookies – Gareth Heyes ล้้้้้้้้้้้้้้้้ Dec 12 '13 at 10:17
  • Good catch. I'd checked that link before but didn't realize the consequences of the escaping they'd used. – Jeremy Banks Dec 12 '13 at 10:18
  • Did you not see a message like this after submitting the contact form? – Jeremy Banks Dec 12 '13 at 10:20
  • Yes and my email response linked me back to the same contact form. – Gareth Heyes ล้้้้้้้้้้้้้้้้ Dec 12 '13 at 10:21
  • 4
    Would you mind going into further detail about what the confirmation email says? That may be a UX issue worth discussing on its own. – Jeremy Banks Dec 12 '13 at 10:24
  • @GarethHeyes I don't understand why you refuse to tell us when did you send the report. If it was only short while ago, just give them some time. – Shadow Dec 12 '13 at 10:25
  • I reported it last week. – Gareth Heyes ล้้้้้้้้้้้้้้้้ Dec 12 '13 at 10:27
  • @JeremyBanks I'll send you the text when I get home tonight. I don't have the email to hand right now. – Gareth Heyes ล้้้้้้้้้้้้้้้้ Dec 12 '13 at 10:28

Thanks for reporting this and trying to do the right thing - responsible disclosure via our requested channel - we take security vulnerabilities very seriously.

I don't know what exactly happened and why you have only gotten a confirmation email and nothing else, I will be chasing this up internally and ensure this does not recur.

In other news, as you have noted, the XSS vulnerability has been fixed.


My apologies, Gareth - we do take these reports very seriously, and make sure each one is reviewed and responded to by a Real, Live Human™.

Unfortunately, when you emailed us we'd just rolled out a new set of instructions for reporting these, and there was a bit of confusion over how reports should be handled as a result.

(to be specific: we didn't immediately realize that it pointed back at the same "contact" form used for every other "contact us" link)

Again, I sincerely apologize for the confusion; thanks for being persistent!

  • Just rolled out? The page exists for at least two months... what did I miss? – Shadow Dec 12 '13 at 15:26
  • I used the wrong link, @Sha. The new page was put up on the 4th or thereabouts, the same day Gareth contacted us. Note that while the old page has a simple link to "contact us", the new page has a Big Red Button on it. Which... goes to the same place. Such a tease. – Shog9 Dec 12 '13 at 15:36
  • @ShaWizDowArd - At least two months... aka 6-8 weeks ;) – Travis J Dec 12 '13 at 15:38
  • Thanks for fixing but still, nothing new regarding the reporting procedure itself as far as I can see... unless you mean something changed behind the scenes where you handle those reports? – Shadow Dec 12 '13 at 15:41
  • That's because there isn't anything new regarding the actual procedures: it's still "1) verify report (if possible), 2) forward to the dev team". We don't do automated responses or priority queues or anything else like that; this was simply a bit of confusion caused by poor communication internally - even though the new page looks like it does something different, it was (and is) supposed to be handled in exactly the same manner as the old page. @Sha – Shog9 Dec 12 '13 at 15:43
  • Fair enough. So you mean the OP here got response saying "Please report this using [link to form here]"? – Shadow Dec 12 '13 at 15:46
  • Correct, @Sha. Which of course, took him right back to where he started. – Shog9 Dec 12 '13 at 15:46
  • Oh, endless loop. Wonderful! ;) – Shadow Dec 12 '13 at 15:46
  • 3
    It's all good until your stack overflows. – Shog9 Dec 12 '13 at 15:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .