XSS in dp.la in dpla/dpla-frontend

Valid

Reported on

Nov 7th 2022

Description

dpla-frontend which is a frontend application of dp.la is vulnerable to XSS.

Proof of Concept

https://dp.la/item?itemId=%3C/script%3E%3Cdiv%20style=%27color:red;font-size:100px;position:fixed;top:0;left:0;width:100%;height:100vh;background:white;%27%3Einput%20your%20password%3Cinput%3E%3C/div%3E%3Cxmp%3E/../../../2cfb4681d6dfe4dc3dd4a2c83d58ca7e

dp.la is protected with a content security policy against the execution of malicious JavaScript, but the site is vulnerable to HTML injection and the source code repository itself is vulnerable to XSS.

Impact

A malicious JavaScript is evaluated on the website, which may allow the attacker to transfer private information such as cookies, which may include session information, from the victim's machine to the attacker. Phishing attacks could be used to emulate trusted web sites and trick the victim into entering a password, allowing the attacker to compromise the victim's account on that web site.

We are processing your report and will contact the dpla/dpla-frontend team within 24 hours. a year ago

We created a GitHub Issue asking the maintainers to create a SECURITY.md a year ago

We have contacted a member of the dpla/dpla-frontend team and are waiting to hear back a year ago

We have sent a follow up to the dpla/dpla-frontend team. We will try again in 7 days. a year ago

We have sent a second follow up to the dpla/dpla-frontend team. We will try again in 10 days. a year ago

We have sent a third and final follow up to the dpla/dpla-frontend team. This report is now considered stale. a year ago

Michael Della Bitta validated this vulnerability a year ago

tyage has been awarded the disclosure bounty

The fix bounty is now up for grabs

The researcher's credibility has increased: +7

Michael Della Bitta marked this as fixed in 0 with commit cdc373 a year ago

Michael Della Bitta has been awarded the fix bounty

This vulnerability will not receive a CVE

Michael Della Bitta published this vulnerability a year ago

to join this conversation