{"action":"closed","issue":{"url":"https://api.github.com/repos/Snorby/snorby/issues/377","labels_url":"https://api.github.com/repos/Snorby/snorby/issues/377/labels{/name}","comments_url":"https://api.github.com/repos/Snorby/snorby/issues/377/comments","events_url":"https://api.github.com/repos/Snorby/snorby/issues/377/events","html_url":"https://github.com/Snorby/snorby/issues/377","id":91936483,"number":377,"title":"Stored Cross-Site Scripting (XSS) Vulnerability","user":{"login":"eurialo","id":1346701,"avatar_url":"https://avatars.githubusercontent.com/u/1346701?v=3","gravatar_id":"","url":"https://api.github.com/users/eurialo","html_url":"https://github.com/eurialo","followers_url":"https://api.github.com/users/eurialo/followers","following_url":"https://api.github.com/users/eurialo/following{/other_user}","gists_url":"https://api.github.com/users/eurialo/gists{/gist_id}","starred_url":"https://api.github.com/users/eurialo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eurialo/subscriptions","organizations_url":"https://api.github.com/users/eurialo/orgs","repos_url":"https://api.github.com/users/eurialo/repos","events_url":"https://api.github.com/users/eurialo/events{/privacy}","received_events_url":"https://api.github.com/users/eurialo/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-06-29T23:43:22Z","updated_at":"2015-07-01T12:27:20Z","closed_at":"2015-07-01T12:27:20Z","body":"Latest version of snorby is vulnerable to cross-site scripting attack.\r\nThese are the steps to reproduce the bug:\r\n\r\n1) Start **Snorby** in production-mode and log in the **web UI**.\r\n2) Go to '**Administration**' -> '**Classifications**' and '**Add classification**'.\r\n3) In the title of classification just add the xss vector: title**\">&lt;img src=x onerror=alert(document.cookie)>**\r\n4) Come back to dashboard and click to '**My Queue**' and see the alert.\r\n\r\nThe output from the page **snorby/app/views/events/_menu.html.erb** is not properly sanitized before its rendering:\r\n\r\n<pre>\r\n<% @classifications.each do |cls| %>\r\n\t<% if cls.locked && cls.hotkey %>\r\n\t\t<%= drop_down_item \"#{cls.name}<span class='shortcut'>#{cls.shortcut}</span>\", '#', nil, { :class => 'classification', :\"data-classification-id\" => cls.id.to_i } %>\r\n\t<% else %>\r\n\t\t<%= drop_down_item \"#{cls.name}\", '#', nil, { :class => 'classification', :\"data-classification-id\" => cls.id.to_i } %>\r\n\t<% end %>\r\n<% end %>\r\n</pre>\r\n\r\nA simple **XSS mitigation** on rails could be the usage of the **sanitize**, for example the code below filters the xss vector by removing the onerror attribute from the image tag:\r\n\r\n<pre>\r\n<% @classifications.each do |cls| %>\r\n\t<% if cls.locked && cls.hotkey %>\r\n\t\t<%= drop_down_item \"#{sanitize cls.name}<span class='shortcut'>#{cls.shortcut}</span>\", '#', nil, { :class => 'classification', :\"data-classification-id\" => cls.id.to_i } %>\r\n\t<% else %>\r\n\t\t<%= drop_down_item \"#{sanitize cls.name}\", '#', nil, { :class => 'classification', :\"data-classification-id\" => cls.id.to_i } %>\r\n\t<% end %>\r\n<% end %>\r\n</pre>\r\n\r\n\r\nThis is a demonstartion screenshot:\r\n\r\n![snorby-xss](https://cloud.githubusercontent.com/assets/1346701/8420963/fde45338-1ec8-11e5-84d8-496819ef1ede.png)\r\n![snorby-render-xss](https://cloud.githubusercontent.com/assets/1346701/8421277/c0fad010-1ecc-11e5-825d-fdac4c3d58e7.png)"}}