Is anyone concerned about this? Has this been tested?

johnny_n

This discussion is related to the Poll addon.

http://bot24.blogspot.com/2012/06/vanilla-forums-version-20184-with-poll.html

http://www.henryhoggard.co.uk/security/vanilla-poll-stored-xss/

fh111

thanks for mentioning this!

Todd

We'll see if the author comments here within a few days. Otherwise, I'll remove the plugin.

leafmonster

Yikes... I use this plugin, but fortunately only my moderators have the permissions to create polls.

I feel like I happened on this thread just by luck... I wish there was a more formal and prominent place where security flaws in the Vanilla ecosystem are announced.

Yeah, someone should change the title of this thread to "SECURITY WARNING for Polls plugin" or something

johnny_n

No problem -- the subject line is terrible, don't know what possessed me to write something like that -- should be "SECURITY WARNING".

peregrine

here's a suggested change to the code to prevent the xss mentioned in this exploit. http://www.henryhoggard.co.uk/security/vanilla-poll-stored-xss/

here is a suggested security fix to the poll plugin

change around line 85 .

class.pollmodule.php


   <?if (!empty($this->_PollData)):?>
       <br />
       <h5><?= stripslashes($this->_PollData->title)?></h5>
       <ul class="poll-answers">
       <? foreach ($this->_PollAnswers->Result() as $Answer):?>
       <? $Percentage =  floor(($Answer->votes / $this->_PollVotes) * 100)?>
       <li class="answer-block">
       <?= Anchor(stripslashes($Answer->title), 'vanilla/discussion/poll/'.$this->_PollData->id.'/vote/'.$Answer->id)?>



to this

<?if (!empty($this->_PollData)):?>
       <br />
        <?php $this->_PollData->title = htmlspecialchars($this->_PollData->title);?>
       <h5><?= stripslashes($this->_PollData->title)?></h5>
       <ul class="poll-answers">
       <? foreach ($this->_PollAnswers->Result() as $Answer):?>
       <? $Percentage =  floor(($Answer->votes / $this->_PollVotes) * 100)?>
       <li class="answer-block">
       <?php $Answer->title = htmlspecialchars($Answer->title);?>
       <?= Anchor(stripslashes($Answer->title), 'vanilla/discussion/poll/'.$this->_PollData->id.'/vote/'.$Answer->id)?>


After the above change the javascript alert box won't pop-up if you enter

<script>alert('xss')</script>  

``into the title or the answers.