Php-Decoda Video Tags Cross-Site Scripting Vulnerability
2 May. 2012
Summary
This allows attackers that should be restricted to the markup supported by Decoda to specify a JavaScript event handler for an iframe tag. Depending on the usage of Decoda, this allows attackers to execute JavaScript code in the context of other users in a web application that uses Decoda.
Decoda supports a directive for videos. For example the Decoda markup:
[video="youtube" size="small"]test[/video]
creates the following corresponding HTML code (whitespace adjusted):
<iframe src="http://www.youtube.com/embed/test" width="560" height="315" frameborder="0"></iframe>
The code to generate the iframe tag can be found in the following file:
decoda/templates/video.php
There, the HTML tag is generated as follows:
--------------------------------- Begin Code ---------------------------------
<?php if ($player == 'embed') { ?>
<embed src="<?php echo $url; ?>"
type="application/x-shockwave-flash"
allowscriptaccess="always"
allowfullscreen="true"
width="<?php echo $width; ?>"
height="<?php echo $height; ?>"></embed>
---------------------------------- End Code ----------------------------------
The variable $url contains the user input provided in the video markup prefixed by the URL to YouTube. Since quotation signs provided by a user are not properly encoded, an attacker can use this to specify a JavaScript event handler that is executed when the resulting HTML document is loaded.
Proof of Concept
The following PHP script can be used to demonstrate this vulnerability:
--------------------------------- Begin Code ---------------------------------
<?php
include '../decoda/Decoda.php';
$code = new Decoda();
$code->addFilter(new VideoFilter()); ?>
<?php
$code->reset($decoda_markup);
echo $code->parse();
?>
---------------------------------- End Code ----------------------------------
This results in the following output (whitespace adjusted):
Disclosure Timeline:
2012-03-26 Vulnerability identified
2012-04-25 Customer approved disclosure to vendor
2012-04-26 First attempt to contact vendor
2012-04-30 Vendor notified
2012-05-01 Vendor released fixed version
2012-05-02 Advisory released
