Common Weakness Enumeration

CWE-79

Allowed

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Abstraction: Base · Status: Stable

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

69480 vulnerabilities reference this CWE, most recent first.

GHSA-G996-Q5R8-W7G2

Vulnerability from github – Published: 2019-11-12 23:00 – Updated: 2024-02-14 15:22

Summary

Symfony Cross-site Scripting (XSS) vulnerability

Details

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.7.51"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.8.0"
            },
            {
              "fixed": "2.8.50"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.4.26"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.1.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "4.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/framework-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.7.51"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/framework-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.8.0"
            },
            {
              "fixed": "2.8.50"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/framework-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.4.26"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/framework-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.1.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/framework-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "4.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.5.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.6.0"
            },
            {
              "fixed": "8.6.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/drupal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.5.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/drupal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.6.0"
            },
            {
              "fixed": "8.6.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-10909"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-11-12T16:48:32Z",
    "nvd_published_at": "2019-05-16T22:29:00Z",
    "severity": "MODERATE"
  },
  "details": "In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.",
  "id": "GHSA-g996-q5r8-w7g2",
  "modified": "2024-02-14T15:22:38Z",
  "published": "2019-11-12T23:00:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10909"
    },
    {
      "type": "WEB",
      "url": "https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml"
    },
    {
      "type": "WEB",
      "url": "https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine"
    },
    {
      "type": "WEB",
      "url": "https://symfony.com/cve-2019-10909"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-core-2019-005"
    },
    {
      "type": "WEB",
      "url": "https://www.synology.com/security/advisory/Synology_SA_19_19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Symfony Cross-site Scripting (XSS) vulnerability"
}

GHSA-G997-CVJ8-H39J

Vulnerability from github – Published: 2023-12-15 12:30 – Updated: 2023-12-16 03:30

Details

Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-48559"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-15T11:15:34Z",
    "severity": "MODERATE"
  },
  "details": "Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.",
  "id": "GHSA-g997-cvj8-h39j",
  "modified": "2023-12-16T03:30:19Z",
  "published": "2023-12-15T12:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48559"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G998-MR8Q-M629

Vulnerability from github – Published: 2022-05-02 03:15 – Updated: 2022-05-02 03:15

Details

Multiple cross-site scripting (XSS) vulnerabilities in Bioinformatics htmLawed 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via invalid Cascading Style Sheets (CSS) expressions in the style attribute, which is processed by Internet Explorer 7.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2009-0404"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-02-03T19:30:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple cross-site scripting (XSS) vulnerabilities in Bioinformatics htmLawed 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via invalid Cascading Style Sheets (CSS) expressions in the style attribute, which is processed by Internet Explorer 7.",
  "id": "GHSA-g998-mr8q-m629",
  "modified": "2022-05-02T03:15:18Z",
  "published": "2022-05-02T03:15:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0404"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48333"
    },
    {
      "type": "WEB",
      "url": "http://freshmeat.net/projects/htmlawed/?branch_id=74760\u0026release_id=293026"
    },
    {
      "type": "WEB",
      "url": "http://freshmeat.net/projects/htmlawed/?branch_id=74760\u0026release_id=293090"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/51650"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33655"
    },
    {
      "type": "WEB",
      "url": "http://www.bioinformatics.org/phplabware/forum/viewtopic.php?id=85"
    },
    {
      "type": "WEB",
      "url": "http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/htmLawed_README.htm#s4.3"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/33507"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-G9C9-FX42-9W6F

Vulnerability from github – Published: 2023-08-28 21:31 – Updated: 2024-04-04 07:14

Details

A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field.

Severity

4.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-39578"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-28T20:15:08Z",
    "severity": "MODERATE"
  },
  "details": "A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field.",
  "id": "GHSA-g9c9-fx42-9w6f",
  "modified": "2024-04-04T07:14:47Z",
  "published": "2023-08-28T21:31:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39578"
    },
    {
      "type": "WEB",
      "url": "https://github.com/anh91/Zenario-xss/issues/1"
    },
    {
      "type": "WEB",
      "url": "https://panda002.hashnode.dev/a-stored-cross-site-scripting-xss-vulnerability-in-the-create-the-function-of-zenario-cms-v94"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G9CM-CGC6-5PFC

Vulnerability from github – Published: 2024-08-06 15:30 – Updated: 2024-08-06 15:30

Details

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate', 'YearLevel', 'eventdate', 'events', 'Users' and 'YearLevel' parameters in '/report/index.php'.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-33987"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-06T13:15:54Z",
    "severity": "HIGH"
  },
  "details": "Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the  \u0027Attendance\u0027, \u0027attenddate\u0027, \u0027YearLevel\u0027, \u0027eventdate\u0027, \u0027events\u0027, \u0027Users\u0027 and \u0027YearLevel\u0027 parameters in \u0027/report/index.php\u0027.",
  "id": "GHSA-g9cm-cgc6-5pfc",
  "modified": "2024-08-06T15:30:51Z",
  "published": "2024-08-06T15:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33987"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G9CM-RXP7-6GV5

Vulnerability from github – Published: 2026-05-05 19:11 – Updated: 2026-05-13 14:19

Summary

AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers

Details

Summary

objects/notifySubscribers.json.php takes the raw message POST parameter and passes it into sendSiteEmail(), which substitutes it directly into an HTML email template (via str_replace on the {message} placeholder) and renders it with PHPMailer::msgHTML(). There is no HTML sanitization, character escaping, or output encoding on the attacker-controlled message between $_POST['message'] and the rendered email. Any authenticated user with upload permission can therefore broadcast arbitrary HTML — phishing links, tracking pixels, CSS/UI spoofing — to every subscriber on their channel (up to 10,000 recipients per invocation). The email is sent From: the platform's configured contact address and wrapped in the site's official logo and title, so attacker-supplied HTML arrives with the appearance of an official platform communication.

Details

File: objects/notifySubscribers.json.php

10: if (!User::canUpload()) {
11:     forbiddenPage('You can not notify');
12: }
13: forbidIfIsUntrustedRequest('notifySubscribers');
14: $user_id = User::getId();
15: // if admin bring all subscribers
16: if (User::isAdmin()) {
17:     $user_id = '';
18: }
19:
20: require_once 'subscribe.php';
21: setRowCount(10000);
...
23: $Subscribes = Subscribe::getAllSubscribes($user_id);
...
34: $subject = 'Message From Site ' . $config->getWebSiteTitle();
35: $message = $_POST['message'];
36:
37: $resp = sendSiteEmail($to, $subject, $message);

Controls present at the entry point:

User::canUpload() — gates access to any account that can upload (a baseline authenticated uploader role; in typical AVideo configurations where authCanUploadVideos is enabled, this is any logged-in user with a verified email).
forbidIfIsUntrustedRequest('notifySubscribers') — in objects/functionsSecurity.php:138-165, this delegates to isUntrustedRequest() which only validates same-origin via requestComesFromSameDomainAsMyAVideo() (objects/functionsAVideo.php:199-206), i.e. a Referer/Origin header check. It is not a CSRF token. An attacker acting on their own authenticated browser session trivially satisfies the Referer check.

There is no CAPTCHA, no rate limit, no per-recipient quota, and no unsubscribe link. setRowCount(10000) allows up to 10,000 subscriber rows to be pulled and mailed in a single request. For admin callers (User::isAdmin() → $user_id = ''), Subscribe::getAllSubscribes('') returns the entire subscriber set for the platform rather than the caller's channel.

File: objects/functionsMail.php

 59: function sendSiteEmail($to, $subject, $message, $fromEmail = '', $fromName = '')
 60: {
 ...
 78:     $subject = UTF8encode($subject);
 79:     $message = UTF8encode($message);            // UTF-8 normalization, no HTML handling
 80:     $message = createEmailMessageFromTemplate($message);
 ...
119:             $mail = new \PHPMailer\PHPMailer\PHPMailer();
120:             setSiteSendMessage($mail);
...
125:             $systemEmail = $config->getContactEmail();
126:             $systemName  = $config->getWebSiteTitle();
...
136:             $mail->setFrom($systemEmail, !empty($fromName) ? $fromName : $systemName);
...
143:             $mail->msgHTML($message);           // renders as HTML
...
162:             $resp = $mail->send();

266: function createEmailMessageFromTemplate($message)
267: {
268:     if (preg_match("/html>/i", $message)) {
269:         return $message;                       // attacker-supplied full-HTML is returned verbatim
270:     }
...
274:     $text = file_get_contents("{$global['systemRootPath']}view/include/emailTemplate.html");
...
279:     $words   = [$logo, $message, $siteTitle];
280:     $replace = ['{logo}', '{message}', '{siteTitle}'];
281:
282:     return str_replace($replace, $words, $text);   // raw substitution into HTML template
283: }

Execution flow from attacker input to sink:

$_POST['message'] → objects/notifySubscribers.json.php:35 (raw, no validation).
→ sendSiteEmail($to, $subject, $message) at objects/notifySubscribers.json.php:37.
→ UTF8encode($message) at objects/functionsMail.php:79 (encoding only; does not strip or escape HTML).
→ createEmailMessageFromTemplate($message) at objects/functionsMail.php:80 → str_replace('{message}', $message, $text) at objects/functionsMail.php:282, substituting attacker HTML directly into the {message} placeholder in view/include/emailTemplate.html.
→ $mail->msgHTML($message) at objects/functionsMail.php:143. PHPMailer renders the combined template (containing the attacker's unsanitized HTML) as an HTML email.
The From: header is $config->getContactEmail() / $config->getWebSiteTitle() (objects/functionsMail.php:125-136). The template contains the platform's logo via getURL($config->getLogo()). The result is an attacker-controlled HTML body delivered from the platform's trusted sender address, officially branded.

Note that the preg_match("/html>/i", $message) at line 268 actively helps the attacker: any payload containing <html> short-circuits template substitution and is sent as-is, allowing the attacker to control the full email body including DOCTYPE, head, and body.

PoC

Obtain an account with upload permission (on AVideo installations where authCanUploadVideos is enabled, any registered and email-verified user qualifies). An admin account broadens the recipient set to the entire platform rather than just the attacker's own subscribers.
Ensure the attacker's channel has at least one subscriber (via Subscribe::getAllSubscribes($user_id)), or use an admin account to target all platform subscribers.
Submit the request. The Referer header must match the platform origin to pass forbidIfIsUntrustedRequest (trivial when running from the attacker's own authenticated browser):

curl -b 'PHPSESSID=<uploader_session>' -X POST \
  -H 'Referer: https://target.example/' \
  'https://target.example/objects/notifySubscribers.json.php' \
  --data-urlencode 'message=<h1 style="color:#c00">Action Required: Verify Your Account</h1>
<p>Dear Subscriber,</p>
<p>We detected unusual activity on your account. Please
<a href="https://attacker.example/phish">click here to verify your identity within 24 hours</a>
or your account will be suspended.</p>
<p>Thank you,<br>The Support Team</p>
<img src="https://attacker.example/track.png" width="1" height="1">'

Expected response:

{"error": false, "msg": ""}

Every subscriber in the target set receives an HTML email:
From: <contact@target.example> (the platform's configured contact email — not the attacker's address).
Subject: Message From Site <SiteTitle> - <SiteTitle> (built at objects/notifySubscribers.json.php:34 + objects/functionsMail.php:138-141).
Body: the view/include/emailTemplate.html template with the platform's real logo substituted at {logo} and the attacker's unsanitized HTML substituted at {message}, including the phishing anchor and tracking pixel.
Delivery is batched via partition($to, $size) at objects/functionsMail.php:114-118 over up to 10,000 subscribers in a single request. There is no rate limit, CAPTCHA, confirmation step, or unsubscribe header.

Impact

Any authenticated uploader can weaponize the platform's own email infrastructure and brand (contact email, logo, site title) to deliver phishing content to their channel subscribers.
Because the From: address is the platform's canonical contact email and the template wraps the attacker content in the official logo and site title, recipients have no visible indication that the content originated from an uploader rather than the operator. Recipients who have previously received legitimate notifications from the same address are especially likely to trust the email.
Phishing payloads can include credential-stealing links mimicking password reset / account verification flows, tracking pixels that enumerate subscriber IPs and mail-client metadata, and CSS-based UI spoofing over the template.
An admin account (User::isAdmin() → $user_id = '') expands the blast radius to every subscriber record on the platform, not just the attacker's own subscribers.
Up to 10,000 recipients per request with no rate limiting, CAPTCHA, or unsubscribe link, so a compromised or malicious uploader can sustain large phishing campaigns at minimal cost, while the sending IP reputation is borne by the platform operator.
A stolen uploader session (e.g., via an unrelated XSS or token leak) is sufficient to mount the attack; no additional credentials or admin access are required.

Recommended Fix

Sanitize or encode $_POST['message'] before it reaches PHPMailer::msgHTML(). Options, in order of preference:

Reject HTML outright and force plain text. In objects/notifySubscribers.json.php:

php $message = $_POST['message'] ?? ''; // Strip all HTML; allow only newlines / plain text. $message = strip_tags($message); $message = nl2br(htmlspecialchars($message, ENT_QUOTES | ENT_HTML5, 'UTF-8'));

Or allow a very restricted subset using a proven HTML sanitizer (e.g. HTMLPurifier with a minimal whitelist: p, br, strong, em, a[href|title], ul, ol, li), and forbid <script>, <style>, inline event handlers, <img>, <iframe>, data:/javascript: URIs, and framework-style template tokens.
Additionally remove the preg_match("/html>/i", $message) short-circuit at objects/functionsMail.php:268-270, which lets a caller replace the entire email body by including a <html> tag. The template should always be applied.
Defense in depth:
Require a real anti-CSRF token on this endpoint (e.g. validateCSRF() with a per-session token in a header or POST field), and drop the Referer-only forbidIfIsUntrustedRequest as the sole protection.
Require User::isAdmin() to notify subscribers from accounts not scoped to a channel; for non-admin uploaders, make the From display name clearly attribute the message to the uploader ("{uploaderName} via {siteTitle} <contact@site>" already works for non-system senders in objects/functionsMail.php:130-134 — apply the same attribution to subscriber notifications).
Enforce per-account and per-IP rate limits on notifySubscribers.json.php (e.g. one broadcast per account per N hours, max M recipients per day).
Include a List-Unsubscribe header and a per-recipient unsubscribe link.
Add a preview + confirmation step before dispatch.

Severity

6.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43876"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T19:11:32Z",
    "nvd_published_at": "2026-05-11T22:22:11Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`objects/notifySubscribers.json.php` takes the raw `message` POST parameter and passes it into `sendSiteEmail()`, which substitutes it directly into an HTML email template (via `str_replace` on the `{message}` placeholder) and renders it with `PHPMailer::msgHTML()`. There is no HTML sanitization, character escaping, or output encoding on the attacker-controlled `message` between `$_POST[\u0027message\u0027]` and the rendered email. Any authenticated user with upload permission can therefore broadcast arbitrary HTML \u2014 phishing links, tracking pixels, CSS/UI spoofing \u2014 to every subscriber on their channel (up to 10,000 recipients per invocation). The email is sent From: the platform\u0027s configured contact address and wrapped in the site\u0027s official logo and title, so attacker-supplied HTML arrives with the appearance of an official platform communication.\n\n## Details\n\n**File:** `objects/notifySubscribers.json.php`\n\n```php\n10: if (!User::canUpload()) {\n11:     forbiddenPage(\u0027You can not notify\u0027);\n12: }\n13: forbidIfIsUntrustedRequest(\u0027notifySubscribers\u0027);\n14: $user_id = User::getId();\n15: // if admin bring all subscribers\n16: if (User::isAdmin()) {\n17:     $user_id = \u0027\u0027;\n18: }\n19:\n20: require_once \u0027subscribe.php\u0027;\n21: setRowCount(10000);\n...\n23: $Subscribes = Subscribe::getAllSubscribes($user_id);\n...\n34: $subject = \u0027Message From Site \u0027 . $config-\u003egetWebSiteTitle();\n35: $message = $_POST[\u0027message\u0027];\n36:\n37: $resp = sendSiteEmail($to, $subject, $message);\n```\n\nControls present at the entry point:\n\n- `User::canUpload()` \u2014 gates access to any account that can upload (a baseline authenticated uploader role; in typical AVideo configurations where `authCanUploadVideos` is enabled, this is any logged-in user with a verified email).\n- `forbidIfIsUntrustedRequest(\u0027notifySubscribers\u0027)` \u2014 in `objects/functionsSecurity.php:138-165`, this delegates to `isUntrustedRequest()` which only validates same-origin via `requestComesFromSameDomainAsMyAVideo()` (`objects/functionsAVideo.php:199-206`), i.e. a Referer/Origin header check. It is **not** a CSRF token. An attacker acting on their own authenticated browser session trivially satisfies the Referer check.\n\nThere is no CAPTCHA, no rate limit, no per-recipient quota, and no unsubscribe link. `setRowCount(10000)` allows up to 10,000 subscriber rows to be pulled and mailed in a single request. For admin callers (`User::isAdmin()` \u2192 `$user_id = \u0027\u0027`), `Subscribe::getAllSubscribes(\u0027\u0027)` returns the entire subscriber set for the platform rather than the caller\u0027s channel.\n\n**File:** `objects/functionsMail.php`\n\n```php\n 59: function sendSiteEmail($to, $subject, $message, $fromEmail = \u0027\u0027, $fromName = \u0027\u0027)\n 60: {\n ...\n 78:     $subject = UTF8encode($subject);\n 79:     $message = UTF8encode($message);            // UTF-8 normalization, no HTML handling\n 80:     $message = createEmailMessageFromTemplate($message);\n ...\n119:             $mail = new \\PHPMailer\\PHPMailer\\PHPMailer();\n120:             setSiteSendMessage($mail);\n...\n125:             $systemEmail = $config-\u003egetContactEmail();\n126:             $systemName  = $config-\u003egetWebSiteTitle();\n...\n136:             $mail-\u003esetFrom($systemEmail, !empty($fromName) ? $fromName : $systemName);\n...\n143:             $mail-\u003emsgHTML($message);           // renders as HTML\n...\n162:             $resp = $mail-\u003esend();\n```\n\n```php\n266: function createEmailMessageFromTemplate($message)\n267: {\n268:     if (preg_match(\"/html\u003e/i\", $message)) {\n269:         return $message;                       // attacker-supplied full-HTML is returned verbatim\n270:     }\n...\n274:     $text = file_get_contents(\"{$global[\u0027systemRootPath\u0027]}view/include/emailTemplate.html\");\n...\n279:     $words   = [$logo, $message, $siteTitle];\n280:     $replace = [\u0027{logo}\u0027, \u0027{message}\u0027, \u0027{siteTitle}\u0027];\n281:\n282:     return str_replace($replace, $words, $text);   // raw substitution into HTML template\n283: }\n```\n\nExecution flow from attacker input to sink:\n\n1. `$_POST[\u0027message\u0027]` \u2192 `objects/notifySubscribers.json.php:35` (raw, no validation).\n2. \u2192 `sendSiteEmail($to, $subject, $message)` at `objects/notifySubscribers.json.php:37`.\n3. \u2192 `UTF8encode($message)` at `objects/functionsMail.php:79` (encoding only; does not strip or escape HTML).\n4. \u2192 `createEmailMessageFromTemplate($message)` at `objects/functionsMail.php:80` \u2192 `str_replace(\u0027{message}\u0027, $message, $text)` at `objects/functionsMail.php:282`, substituting attacker HTML directly into the `{message}` placeholder in `view/include/emailTemplate.html`.\n5. \u2192 `$mail-\u003emsgHTML($message)` at `objects/functionsMail.php:143`. PHPMailer renders the combined template (containing the attacker\u0027s unsanitized HTML) as an HTML email.\n6. The `From:` header is `$config-\u003egetContactEmail()` / `$config-\u003egetWebSiteTitle()` (`objects/functionsMail.php:125-136`). The template contains the platform\u0027s logo via `getURL($config-\u003egetLogo())`. The result is an attacker-controlled HTML body delivered from the platform\u0027s trusted sender address, officially branded.\n\nNote that the `preg_match(\"/html\u003e/i\", $message)` at line 268 actively *helps* the attacker: any payload containing `\u003chtml\u003e` short-circuits template substitution and is sent as-is, allowing the attacker to control the full email body including DOCTYPE, head, and body.\n\n## PoC\n\n1. Obtain an account with upload permission (on AVideo installations where `authCanUploadVideos` is enabled, any registered and email-verified user qualifies). An admin account broadens the recipient set to the entire platform rather than just the attacker\u0027s own subscribers.\n2. Ensure the attacker\u0027s channel has at least one subscriber (via `Subscribe::getAllSubscribes($user_id)`), or use an admin account to target all platform subscribers.\n3. Submit the request. The `Referer` header must match the platform origin to pass `forbidIfIsUntrustedRequest` (trivial when running from the attacker\u0027s own authenticated browser):\n\n```bash\ncurl -b \u0027PHPSESSID=\u003cuploader_session\u003e\u0027 -X POST \\\n  -H \u0027Referer: https://target.example/\u0027 \\\n  \u0027https://target.example/objects/notifySubscribers.json.php\u0027 \\\n  --data-urlencode \u0027message=\u003ch1 style=\"color:#c00\"\u003eAction Required: Verify Your Account\u003c/h1\u003e\n\u003cp\u003eDear Subscriber,\u003c/p\u003e\n\u003cp\u003eWe detected unusual activity on your account. Please\n\u003ca href=\"https://attacker.example/phish\"\u003eclick here to verify your identity within 24 hours\u003c/a\u003e\nor your account will be suspended.\u003c/p\u003e\n\u003cp\u003eThank you,\u003cbr\u003eThe Support Team\u003c/p\u003e\n\u003cimg src=\"https://attacker.example/track.png\" width=\"1\" height=\"1\"\u003e\u0027\n```\n\n4. Expected response:\n\n```json\n{\"error\": false, \"msg\": \"\"}\n```\n\n5. Every subscriber in the target set receives an HTML email:\n   - `From:` `\u003ccontact@target.example\u003e` (the platform\u0027s configured contact email \u2014 not the attacker\u0027s address).\n   - `Subject:` `Message From Site \u003cSiteTitle\u003e - \u003cSiteTitle\u003e` (built at `objects/notifySubscribers.json.php:34` + `objects/functionsMail.php:138-141`).\n   - Body: the `view/include/emailTemplate.html` template with the platform\u0027s real logo substituted at `{logo}` and the attacker\u0027s unsanitized HTML substituted at `{message}`, including the phishing anchor and tracking pixel.\n\n6. Delivery is batched via `partition($to, $size)` at `objects/functionsMail.php:114-118` over up to 10,000 subscribers in a single request. There is no rate limit, CAPTCHA, confirmation step, or unsubscribe header.\n\n## Impact\n\n- Any authenticated uploader can weaponize the platform\u0027s own email infrastructure and brand (contact email, logo, site title) to deliver phishing content to their channel subscribers.\n- Because the `From:` address is the platform\u0027s canonical contact email and the template wraps the attacker content in the official logo and site title, recipients have no visible indication that the content originated from an uploader rather than the operator. Recipients who have previously received legitimate notifications from the same address are especially likely to trust the email.\n- Phishing payloads can include credential-stealing links mimicking password reset / account verification flows, tracking pixels that enumerate subscriber IPs and mail-client metadata, and CSS-based UI spoofing over the template.\n- An admin account (`User::isAdmin()` \u2192 `$user_id = \u0027\u0027`) expands the blast radius to every subscriber record on the platform, not just the attacker\u0027s own subscribers.\n- Up to 10,000 recipients per request with no rate limiting, CAPTCHA, or unsubscribe link, so a compromised or malicious uploader can sustain large phishing campaigns at minimal cost, while the sending IP reputation is borne by the platform operator.\n- A stolen uploader session (e.g., via an unrelated XSS or token leak) is sufficient to mount the attack; no additional credentials or admin access are required.\n\n## Recommended Fix\n\nSanitize or encode `$_POST[\u0027message\u0027]` before it reaches `PHPMailer::msgHTML()`. Options, in order of preference:\n\n1. **Reject HTML outright** and force plain text. In `objects/notifySubscribers.json.php`:\n\n   ```php\n   $message = $_POST[\u0027message\u0027] ?? \u0027\u0027;\n   // Strip all HTML; allow only newlines / plain text.\n   $message = strip_tags($message);\n   $message = nl2br(htmlspecialchars($message, ENT_QUOTES | ENT_HTML5, \u0027UTF-8\u0027));\n   ```\n\n2. **Or** allow a very restricted subset using a proven HTML sanitizer (e.g. `HTMLPurifier` with a minimal whitelist: `p, br, strong, em, a[href|title], ul, ol, li`), and forbid `\u003cscript\u003e`, `\u003cstyle\u003e`, inline event handlers, `\u003cimg\u003e`, `\u003ciframe\u003e`, `data:`/`javascript:` URIs, and framework-style template tokens.\n\n3. **Additionally** remove the `preg_match(\"/html\u003e/i\", $message)` short-circuit at `objects/functionsMail.php:268-270`, which lets a caller replace the entire email body by including a `\u003chtml\u003e` tag. The template should always be applied.\n\n4. **Defense in depth:**\n   - Require a real anti-CSRF token on this endpoint (e.g. `validateCSRF()` with a per-session token in a header or POST field), and drop the Referer-only `forbidIfIsUntrustedRequest` as the sole protection.\n   - Require `User::isAdmin()` to notify subscribers from accounts not scoped to a channel; for non-admin uploaders, make the `From` display name clearly attribute the message to the uploader (`\"{uploaderName} via {siteTitle} \u003ccontact@site\u003e\"` already works for non-system senders in `objects/functionsMail.php:130-134` \u2014 apply the same attribution to subscriber notifications).\n   - Enforce per-account and per-IP rate limits on `notifySubscribers.json.php` (e.g. one broadcast per account per N hours, max M recipients per day).\n   - Include a List-Unsubscribe header and a per-recipient unsubscribe link.\n   - Add a preview + confirmation step before dispatch.",
  "id": "GHSA-g9cm-rxp7-6gv5",
  "modified": "2026-05-13T14:19:33Z",
  "published": "2026-05-05T19:11:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-g9cm-rxp7-6gv5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43876"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/078c4342eb9969a70425a9cdca3eefa7f8a86d53"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers"
}

GHSA-G9CP-6QCQ-XFW7

Vulnerability from github – Published: 2022-05-14 03:08 – Updated: 2022-05-14 03:08

Details

library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 allows self-XSS via $session['user_agent'] in the "Login Sessions" feature.

Severity

6.1 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-12580"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-06-19T16:29:00Z",
    "severity": "MODERATE"
  },
  "details": "library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 allows self-XSS via $session[\u0027user_agent\u0027] in the \"Login Sessions\" feature.",
  "id": "GHSA-g9cp-6qcq-xfw7",
  "modified": "2022-05-14T03:08:15Z",
  "published": "2022-05-14T03:08:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12580"
    },
    {
      "type": "WEB",
      "url": "https://www.dragonbyte-tech.com/threads/security-bulletin-low-vbsecurity-for-vbulletin-3-vbulletin-4-partial-xss.22534"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G9CP-9FW3-56CF

Vulnerability from github – Published: 2022-11-22 15:30 – Updated: 2025-04-29 15:35

Summary

Cross-site Scripting in Backdrop CMS

Details

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.'s

Severity

4.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backdrop/backdrop"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.23.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-42097"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-22T19:14:12Z",
    "nvd_published_at": "2022-11-22T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \u0027Comment.\u0027s",
  "id": "GHSA-g9cp-9fw3-56cf",
  "modified": "2025-04-29T15:35:36Z",
  "published": "2022-11-22T15:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42097"
    },
    {
      "type": "WEB",
      "url": "https://backdropcms.org"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backdrop/backdrop/releases/tag/1.23.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bypazs/CVE-2022-42097"
    },
    {
      "type": "WEB",
      "url": "https://grimthereaperteam.medium.com/cve-2022-42097-backdrop-xss-at-comments-2ea536ec55e1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-site Scripting in Backdrop CMS"
}

GHSA-G9CR-7JH8-QRMX

Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03

Details

A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-3509"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-27T00:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.",
  "id": "GHSA-g9cr-7jh8-qrmx",
  "modified": "2022-05-24T19:03:32Z",
  "published": "2022-05-24T19:03:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3509"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ceph/ceph/commit/7a1ca8d372da3b6a4fc3d221a0e5f72d1d61c27b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ceph/ceph/commit/adda853e64bdba1288d46bc7d462d23d8f2f10ca"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ceph/ceph/commit/af3fffab3b0f13057134d96e5d481e400d8bfd27"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1950116"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ceph/ceph/blob/f1557e8f62d31883d3d34ae241a1a26af11d923f/src/pybind/mgr/dashboard/controllers/docs.py#L394-L409"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G9FG-M4X9-VQ3M

Vulnerability from github – Published: 2022-05-17 04:12 – Updated: 2022-05-17 04:12

Details

Cross-site scripting (XSS) vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2015-4366"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-06-15T14:59:00Z",
    "severity": "LOW"
  },
  "details": "Cross-site scripting (XSS) vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.",
  "id": "GHSA-g9fg-m4x9-vq3m",
  "modified": "2022-05-17T04:12:05Z",
  "published": "2022-05-17T04:12:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4366"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/node/2445977"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2015/04/25/6"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/72957"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Mitigation MIT-4

Architecture and Design

Strategy: Libraries or Frameworks

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.

Mitigation

Implementation Architecture and Design

Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies.
For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters.
Parts of the same output document may require different encodings, which will vary depending on whether the output is in the:
etc. Note that HTML Entity Encoding is only appropriate for the HTML body.
Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed.
HTML body
Element attributes (such as src="XYZ")
URIs
JavaScript sections
Cascading Style Sheets and style property

Mitigation MIT-6

Architecture and Design Implementation

Strategy: Attack Surface Reduction

Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.

Mitigation MIT-15

Architecture and Design

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Mitigation MIT-27

Architecture and Design

Strategy: Parameterization

If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.

Mitigation MIT-30.1

Implementation

Strategy: Output Encoding

Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or automatically inferring which encoding is being used, which can be erroneous. When the encodings are inconsistent, the downstream component might treat some character or byte sequences as special, even if they are not special in the original encoding. Attackers might then be able to exploit this discrepancy and conduct injection attacks; they even might be able to bypass protection mechanisms that assume the original encoding is also being used by the downstream component.
The problem of inconsistent output encodings often arises in web pages. If an encoding is not specified in an HTTP header, web browsers often guess about which encoding is being used. This can open up the browser to subtle XSS attacks.

Mitigation MIT-43

Implementation

With Struts, write all data from form beans with the bean's filter attribute set to true.

Mitigation MIT-31

Implementation

Strategy: Attack Surface Reduction

To help mitigate XSS attacks against the user's session cookie, set the session cookie to be HttpOnly. In browsers that support the HttpOnly feature (such as more recent versions of Internet Explorer and Firefox), this attribute can prevent the user's session cookie from being accessible to malicious client-side scripts that use document.cookie. This is not a complete solution, since HttpOnly is not supported by all browsers. More importantly, XmlHttpRequest and other powerful browser technologies provide read access to HTTP headers, including the Set-Cookie header in which the HttpOnly flag is set.

Mitigation MIT-5

Implementation

Strategy: Input Validation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
When dynamically constructing web pages, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. All input should be validated and cleansed, not just parameters that the user is supposed to specify, but all data in the request, including hidden fields, cookies, headers, the URL itself, and so forth. A common mistake that leads to continuing XSS vulnerabilities is to validate only fields that are expected to be redisplayed by the site. It is common to see data from the request that is reflected by the application server or the application that the development team did not anticipate. Also, a field that is not currently reflected may be used by a future developer. Therefore, validating ALL parts of the HTTP request is recommended.
Note that proper output encoding, escaping, and quoting is the most effective solution for preventing XSS, although input validation may provide some defense-in-depth. This is because it effectively limits what will appear in output. Input validation will not always prevent XSS, especially if you are required to support free-form text fields that could contain arbitrary characters. For example, in a chat application, the heart emoticon ("<3") would likely pass the validation step, since it is commonly used. However, it cannot be directly inserted into the web page because it contains the "<" character, which would need to be escaped or otherwise handled. In this case, stripping the "<" might reduce the risk of XSS, but it would produce incorrect behavior because the emoticon would not be recorded. This might seem to be a minor inconvenience, but it would be more important in a mathematical forum that wants to represent inequalities.
Even if you make a mistake in your validation (such as forgetting one out of 100 input fields), appropriate encoding is still likely to protect you from injection-based attacks. As long as it is not done in isolation, input validation is still a useful technique, since it may significantly reduce your attack surface, allow you to detect some attacks, and provide other security benefits that proper encoding does not address.
Ensure that you perform input validation at well-defined interfaces within the application. This will help protect the application even if a component is reused or moved elsewhere.

Mitigation MIT-21

Architecture and Design

Strategy: Enforcement by Conversion

When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

Mitigation MIT-29

Operation

Strategy: Firewall

Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

Mitigation MIT-16

Operation Implementation

Strategy: Environment Hardening

When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.

CAPEC-209: XSS Using MIME Type Mismatch

An adversary creates a file with scripting content but where the specified MIME type of the file is such that scripting is not expected. The adversary tricks the victim into accessing a URL that responds with the script file. Some browsers will detect that the specified MIME type of the file does not match the actual type of its content and will automatically switch to using an interpreter for the real content type. If the browser does not invoke script filters before doing this, the adversary's script may run on the target unsanitized, possibly revealing the victim's cookies or executing arbitrary script in their browser.

CAPEC-588: DOM-Based XSS

This type of attack is a form of Cross-Site Scripting (XSS) where a malicious script is inserted into the client-side HTML being parsed by a web browser. Content served by a vulnerable web application includes script code used to manipulate the Document Object Model (DOM). This script code either does not properly validate input, or does not perform proper output encoding, thus creating an opportunity for an adversary to inject a malicious script launch a XSS attack. A key distinction between other XSS attacks and DOM-based attacks is that in other XSS attacks, the malicious script runs when the vulnerable web page is initially loaded, while a DOM-based attack executes sometime after the page loads. Another distinction of DOM-based attacks is that in some cases, the malicious script is never sent to the vulnerable web server at all. An attack like this is guaranteed to bypass any server-side filtering attempts to protect users.

CAPEC-591: Reflected XSS

This type of attack is a form of Cross-Site Scripting (XSS) where a malicious script is "reflected" off a vulnerable web application and then executed by a victim's browser. The process starts with an adversary delivering a malicious script to a victim and convincing the victim to send the script to the vulnerable web application.

CAPEC-592: Stored XSS

An adversary utilizes a form of Cross-site Scripting (XSS) where a malicious script is persistently "stored" within the data storage of a vulnerable web application as valid input.

CAPEC-63: Cross-Site Scripting (XSS)

An adversary embeds malicious scripts in content that will be served to web browsers. The goal of the attack is for the target software, the client-side browser, to execute the script with the users' privilege level. An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute code and scripts. Web browsers, for example, have some simple security controls in place, but if a remote attacker is allowed to execute scripts (through injecting them in to user-generated content like bulletin boards) then these controls may be bypassed. Further, these attacks are very difficult for an end user to detect.

CAPEC-85: AJAX Footprinting

This attack utilizes the frequent client-server roundtrips in Ajax conversation to scan a system. While Ajax does not open up new vulnerabilities per se, it does optimize them from an attacker point of view. A common first step for an attacker is to footprint the target environment to understand what attacks will work. Since footprinting relies on enumeration, the conversational pattern of rapid, multiple requests and responses that are typical in Ajax applications enable an attacker to look for many vulnerabilities, well-known ports, network locations and so on. The knowledge gained through Ajax fingerprinting can be used to support other attacks, such as XSS.

← Back to the CWE list