XSS in dp.la in dpla/dpla-frontend

Valid

Reported on

Nov 7th 2022


Description

dpla-frontend which is a frontend application of dp.la is vulnerable to XSS.

Proof of Concept

https://dp.la/item?itemId=%3C/script%3E%3Cdiv%20style=%27color:red;font-size:100px;position:fixed;top:0;left:0;width:100%;height:100vh;background:white;%27%3Einput%20your%20password%3Cinput%3E%3C/div%3E%3Cxmp%3E/../../../2cfb4681d6dfe4dc3dd4a2c83d58ca7e

dp.la is protected with a content security policy against the execution of malicious JavaScript, but the site is vulnerable to HTML injection and the source code repository itself is vulnerable to XSS.

Impact

A malicious JavaScript is evaluated on the website, which may allow the attacker to transfer private information such as cookies, which may include session information, from the victim's machine to the attacker. Phishing attacks could be used to emulate trusted web sites and trick the victim into entering a password, allowing the attacker to compromise the victim's account on that web site.

We are processing your report and will contact the dpla/dpla-frontend team within 24 hours. 2 months ago
We created a GitHub Issue asking the maintainers to create a SECURITY.md 2 months ago
We have contacted a member of the dpla/dpla-frontend team and are waiting to hear back 2 months ago
We have sent a follow up to the dpla/dpla-frontend team. We will try again in 7 days. 2 months ago
We have sent a second follow up to the dpla/dpla-frontend team. We will try again in 10 days. 2 months ago
We have sent a third and final follow up to the dpla/dpla-frontend team. This report is now considered stale. a month ago
Michael Della Bitta validated this vulnerability a month ago
tyage has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Michael Della Bitta marked this as fixed in 0 with commit cdc373 a month ago
Michael Della Bitta has been awarded the fix bounty
This vulnerability will not receive a CVE
Michael Della Bitta published this vulnerability a month ago
to join this conversation