Project

General

Profile

Actions
Copy link

Bug #16974

open

Potential XSS via ACME Account Key Names

Added by Jim Pingle 3 days ago. Updated about 10 hours ago.

Status:
Feedback
Priority:
Normal
Assignee:
Jim Pingle
Category:
ACME
Target version:
-
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:

Description

The acme_accountkeys.php page uses ACME account key name in JavaScript with incomplete encoding protection, which can lead to a potential XSS.

1. Create an account key with a name such as: testkey123
2. Create another account key that starts with the same name, but then includes an XSS payload: testkey123');alert(String.fromCharCode(88,83,83));//

When attempting to edit the entry by clicking on the pencil icon, or double clicking the entry, the XSS will trigger.

Reported by: @lujiefsi

Actions
Copy link
 #1

Updated by Jim Pingle 3 days ago

  • Description updated (diff)
Actions
Copy link
 #2

Updated by Jim Pingle about 10 hours ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100
  • Private changed from Yes to No

Fixed in ACME pkg v1.3

Actions
Copy link

Also available in: Atom PDF