[MDL-58409] Self-XSS in autocomplete element (for example "Tags") - Moodle Tracker

XML

Word

Printable

Affected Branches:
MOODLE_31_STABLE, MOODLE_32_STABLE, MOODLE_34_STABLE, MOODLE_35_STABLE, MOODLE_36_STABLE
Fixed Branches:
MOODLE_34_STABLE, MOODLE_35_STABLE
Pull from Repository:
https://github.com/dravek/moodle
Pull Master Branch:
~~MDL-58409~~-master_needs_clean_in_autocomplete_element
Pull Master Diff URL:
https://github.com/moodle/moodle/compare/master...dravek:MDL-58409-master_needs_clean_in_autocomplete_element?expand=1
Difficulty:
Easy
Testing Instructions:
Hide

Create a new activity instance (e.g. Assign) and edit the settings for this module once done.

In the Tags text field under the Tags section, enter:

<script>alert("XSS!");</script>

and hit enter

Verify you don't see a browser alert and;

Verify you see the tag created above the field, with the content you entered.

Repeat steps 1-4 for a course tag, using the course edit form.
Show
Create a new activity instance (e.g. Assign) and edit the settings for this module once done. In the Tags text field under the Tags section, enter: <script>alert( "XSS!" );</script> and hit enter Verify you don't see a browser alert and; Verify you see the tag created above the field, with the content you entered. Repeat steps 1-4 for a course tag, using the course edit form.

I am reporting a XSS security issues in accordance with Bug in Tag feature.

Tag feature in any pages has XSS vulnerability.

Here are steps for how to reproduce below.

(1) Create a new quiz instance, open edit from.

(2) Enter <script> tag e.g(<script>alert("XSS!");</script>)

(3) !?

has a non-specific relationship to

MDL-61359 Self-XSS when sending message to another user

is duplicated by

MDL-58923 Autocomplete form element does not escape string when adding to the list of tags for the editing user

Testing discovered

MDL-63082 Encoding problem with tags saved with special characters

Participants:: Anna Carissa Sadia, CiBoT, David Carrillo, Eloy Lafuente (stronk7), Jake Dallimore, Marina Glancy, Michael Hawkins, Takayuki Fuwa

Component watchers:: David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo, David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo, David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo

Estimated:

Remaining:

Logged:

30m