PT-2017-5760 · Validator+1 · Validator+1

Published

2016-02-10

·

Updated

2017-10-24

·

CVE-2013-7454

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: validator versions prior to 1.1.0
Description: The issue allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden strings. Several cross-site scripting vulnerabilities are present due to bypasses discovered in the blacklist-based filter. This includes improper parsing of nested tags, incomplete filtering of javascript: URIs, and UI Redressing. Various inputs that could bypass the filter were discovered, including bypass via nested forbidden strings.
Recommendations: For versions prior to 1.1.0, consider replacing the xss filter function from the validator package with the escape filter function from the same package, as it replaces all instances of angle brackets, ampersands, and quotation marks, preventing HTML tags from being processed.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2016-1086
CVE-2013-7454
GHSA-Q4QQ-FM7Q-CWP5

Affected Products

Alt Linux
Validator