Project

General

Profile

Actions
Copy link

Bug #16647

closed

Possible Scripting vulnerability

Added by Michel Boivin about 18 years ago. Updated over 15 years ago.

Status:
Closed
Priority:
Should have
Assignee:
Marcus Krause
Category:
-
Target version:
-
Start date:
2006-10-16
Due date:
% Done:

0%

Estimated time:
TYPO3 Version:
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

Using the 'Toggle HTML source' button in the RTE (either in frontend or in the backend) allows a user to modify tags created by the RTE so that a script gets run simply by viewing the element (either in the RTE or outside it).

As an example: Modifying following string
<p>Test</p>
into this one:
<p onmouseover="alert('Script was run');">Test</p>
will activate the script and display the alert as soon as mouve hovers the enclosed paragraph. The script gets run in FE and BE mode, inside the RTE (when not in HTML source mode) and outside the RTE when displaying the generated content.

This could present a security threat, since any FE plugin using the RTE with this feature enabled could allow a FE user to input a script that would be run as soon as a BE user edits the saved content in the backend. Since the script could be run in the BE, it could possibly redirect the BE user to a URL that would run an unwanted action on the Typo3 system.

I strongly believe that this is a security issue and that it should be resolved quickly. This would however be my first security report, so I might have forgot to include some info. Just contact me () for further info.

Tested on rteHTMLArea 1.3.7 on Typo3 v4.0.0
(issue imported from #M4397)

Actions
Copy link

Also available in: Atom PDF