Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

XSS vulnerability in NCrypt #6

Framartin opened this issue Mar 3, 2017 · 1 comment

XSS vulnerability in NCrypt #6

Framartin opened this issue Mar 3, 2017 · 1 comment


Copy link

For transparency reason (and with the authorization of the NCrypt maintainer), the email I sent to NCrypt the 02/03/2017 is reproduced below:

I just found an XSS vulnerability in NCrypt.

How to reproduce

  • A malicious user create a paste with the content: <script>alert('XSS')</script>
  • (S)he sends the link to the targeted user
  • The targeted user clones the paste
  • The JS payload is executed

As far as I tested it, the choice of programming language don't change the result.

Note: the payload can be "hidden" in a lot of text or code in order to "trick" users.

As far as I know, the impact is quite limited because you don't store the previous posted links in the browser, but it can be used to de-anonymize users for example.

I found this vulnerability because I'm currently and voluntarily searching for XSS vulnerabilities in a lot of FLOSS.

I remain available for any additional comments or questions.


luggs-co added a commit that referenced this issue Mar 3, 2017
Copy link

luggs-co commented Mar 3, 2017


@luggs-co luggs-co closed this as completed Mar 3, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
None yet

No branches or pull requests

2 participants