Flash based XSS

[MantisSTS]

Hi guys,

Wasn't sure where to report this, the main site didn't have a clear email/section for reporting security vulnerabilities that I could find.

So after testing MODX for some basic vulnerabilities, I came across the FileAPI.flash.image.swf file had a parameter called scale & callback.

The callback parameter is vulnerable to XSS, if you close off the try/catch block, then you can execute an alert:

//MODX/manager/assets/fileapi/FileAPI.flash.image.swf?scale=onw1b&callback=%29}catch%28e%29{};alert%281%29;//

I hope this can be of use to you guys.

Thanks.

[adamwintle]

this seems pretty serious and now a few years old, is it still an issue? cc @opengeek

[opengeek]

What is fileapi?

[adamwintle]

@opengeek I have no idea, maybe this http://mailru.github.io/FileAPI/ https://github.com/mailru/FileAPI/blob/master/dist/FileAPI.flash.image.swf

[OptimusCrime]

https://github.com/modxcms/revolution/tree/2.x/manager/assets/fileapi

[christianseel]

Can we please fix this before 2.5.0-pl?

[MantisSTS]

Want me to retest this when I get a second?

[theboxer]

Yes, please, it worked here, hopefully it will for you as well