Bug #19715 Bug Fixed

XSS in the post-submit preview page of a channel entry

Version: EE 2.6.1 Reporter: DarkMantis

The issue is when you submit a new entry through Admin -> Content -> Publish and you are using the RTE, if you enter HTML into that editor, the next page will execute the HTML, which it shouldn’t. The RTE should htmlentities all input data that goes in (when you’re not in the ‘source-view’), thus creating a HTML-Safe preview page.

I was trying to post about a vulnerability I found in a WordPress plugin, and the resulting HTML of the XSS payload was:

</title>[removed]alert(document.domain);[removed]

which got executed on the view_entry.php view (system -> expressionengine -> views -> content -> view_entry.php)

 

  • The solution contains a workaround for now, but in the next version of ExpressionEngine we’re removing this preview feature altogether.

    Wes Baker
    16th September, 2013 at 6:09pm

You must be signed in to comment on a bug report.

  • In system/expressionengine/controllers/cp/content_publish.php look at line 685:

    $r .= ee()->api_channel_fields->apply('replace_tag', array('data' => $data));

    And replace it with this:

    $r .= ee()->api_channel_fields->apply('replace_tag', array('data' => htmlentities($data)));

ExpressionEngine News

#eecms, #events, #releases