Full Disclosure mailing list archives

By Date By Thread Vaadin Javascript Injection From: Caleb Cushing <xenoterracide () gmail com>

Date: Thu, 22 Jun 2017 15:49:49 +0000

first time poster, so I'm not sure if this is the best venue, format, etc. https://github.com/vaadin/framework/issues/8731 using vaadin 7.7.6 using example https://vaadin.com/docs/-/part/framework/components/components-combobox.html but with malicious text that assumes humans are adding the planet names via a form. // List of planets List<Planet> planets = new ArrayList<>(); planets.add(new Planet(1, "<iframe width="560" height="315" src="https://www.youtube.com/embed/dQw4w9WgXcQ?autoplay=1&rel=0" frameborder="0" allowfullscreen></iframe>")); ComboBox<Planet> select = new ComboBox<>("Select or Add a Planet"); select.setItems(planets); select.setDescription(""); // doesn't do anything the combobox will render this as <div onmouseenter="alert('hello')">:Goog</div> but the description (tooltip) will actually render the html and thus allow you to exploit the system. If you encode it first converting < to < then the list itself will have the ugly < which isn't what you want to show for <E> Corp (Mr. Robot :D). The best way to fix this issue is to have an ItemDescriptionGenerator to allow a separate tooltip to be generated from the contents of the list. I've determined this bug is still relevant in 7.7.9. Outside of reminding them, I'm trying to determine the best next steps, whether this should get a CVE, how to go about doing that in spite of upstream ignoring it, whether this is even the appropriate venue to talk about such things. Maybe this shouldn't even be considered a vulnerability, feedback welcome. -- Caleb Cushing http://xenoterracide.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/ By Date By Thread Current thread: Vaadin Javascript Injection Caleb Cushing (Jun 22)