Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 23 Mar 2020 10:06:05 +0100
From: Hanno Böck <>
  "" <>
Subject: Serendipity XSS via update notification (minor, exploitable by s9y

I reported an XSS in Serendipity that is now fixed in version 2.3.3. It
is only exploitable by either the developers of serendipity or someone
compromising Github, so I consider this very minor.

My bug report to s9y [1]:

The version number shown in the update notification window is not
escaped. This means it can contain javascript payload and thus allow

The version information is fetched from a Github URL, which means this
is an XSS vulnerability that can only be exploited by the serendipity
developers or github itself. So this makes it rather low severity.

Still I'd consider safety against the developers or potentially
compromised developer accounts desirable where possible, and this seems
easy to fix.

PoC: Change the $updateURL variable in
include/ in the function
serendipity_getCurrentVersion to one you control and add something like:

stable:9.<img src=x onerror=alert(1)><x
beta:9.<img src=x onerror=alert(2)><x

(s9y adds a </span> somewhere at the end for reasons I don't
understand, by adding the bogus <x I avoid that disturbing my payload.)

Hanno Böck

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.