XSS vulnerability

[Ekzorcist]

Auto-reviewers: @NiharikaRay @matthewwardrop @earthmancash @danfrankj

Hello, guys!

There is a cross-site scripting (XSS) vulnerability in the Knowledge Repo 0.7.4 (other versions may be affected as well) which allows remote attackers to inject arbitrary JavaScript via post comments functionality.

Steps to reproduce:
Just open any post like this https://site.com/post/posts/new_report.kp
and add the following code as a comment/PoC:

<script>alert("Client side attacks is possible here!");</script>

Impact: An unauthenticated evil user can leverage the vulnerability to conduct various types of client side attacks, for example, conducting a browser mining, redirecting users to malicious sites or hijacking the user’s browser using malware.

As an irrefutable evidence please take a look at the attached screen-shot.

Mitigation: Details on how to prevent XSS can be found here: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

PoC:

[matthewwardrop]

Thanks Ekzorcist. I'll make sure this gets fixed before the next release :).

[fahrishb]

XSS is also present on 0.7.6

[therealsphinx]

Is this one fixed @fahrishb?

[naoyak]

Also raised in #254. We should prioritize fixing this.