PageKit > Cross-site scripting (DOM-based) about pagekit HOT 7 OPEN

And no one even replied to this? Amazing.

from pagekit.

Pagekit is (almost) dead. I suggest to head over to biskuit cms (Pagekit fork)

from pagekit.

DOM-based cross-site scripting arises when a script writes controllable data into the HTML document in an unsafe way. An attacker may be able to use the vulnerability to construct a URL that, if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

I don't see how this is possible. The field is filled with either content comming from the database or with content coming from the page user currently visiting the page. Nothing is used from the URL.

Additionally, dupe of #815

from pagekit.

DOM-based cross-site scripting arises when a script writes controllable data into the HTML document in an unsafe way. An attacker may be able to use the vulnerability to construct a URL that, if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

I don't see how this is possible. The field is filled with either content comming from the database or with content coming from the page user currently visiting the page. Nothing is used from the URL.

Additionally, dupe of #815

Well, it is literally explained in the OP how it works. If a logged in user navigates to a purposely crafted url their session might get stollen. For example by clicking the link in the comments. This is not something new.

from pagekit.

Well, it is literally explained in the OP how it works. If a logged in user navigates to a purposely crafted url their session might get stollen.

There is a generic explanation on how such attacks could work. However, it is not stated that this is always possible. In this specific scenario I don't see a possible attack here. Nothing from the URL is passed to the textarea, the textarea is only filled by the user or from server side. The user has to be logged in and have access to the admin panel (which should be granted to trusted users, only).

However, I am open to be convinced by the opposite by a working example.

For example by clicking the link in the comments.

User entered content in the comments is not using this editor component and additionally is sanitized.

This is not something new.

The attack vector is not something new. But, to be a threat it is also require that it can be exploited. And in this particular scenario, I don't see a possibility to exploit.

from pagekit.

Have you inspected an example provided by OP? He managed to inject a code into into DOM via CrossSite request.

P.S. PageKit development is dead anyway so yeah.

from pagekit.

I just see a statement that if a textare on the page is filled with a specific value, then this value is printed to the page. This is correct as this is the design of an HTML editor. However, I don't see steps to reproduce this issue. So, there is nothing I could check. I just see a code analysis of a tool from where I don't get what I have to do to reproduce the issue.

from pagekit.