HexBrain
Open on HackerOneSign in

GitLab · Report #200693

[RDoc] XSS in project README files

Validstatus
mediumseverity
8upvotes
15 Feb 2017disclosed

Summary

Persistent XSS vulnerabilities were identified by way of the RubyDoc, reStructuredText, and Textile markup formats. Thanks again to the GitLab team. I've published a blogpost discussing my findings and the recent Security Release.

How it was found

Hi,

While experimenting with parser bypass techniques, I discovered that RDoc markup could be used to inject a stored JavaScript payload into a project README.rdoc file.

Please note that this issue is separate to my earlier report #200565 (XSS with AsciiDoc markup), marked as duplicate.

Steps to Reproduce

  1. Create a new GitLab project
  2. Initialise the project by creating a README file
  3. Set the file title to README.rdoc
  4. Paste the below Payload into the file
  5. Commit the file to the project and click on the "XSS" link

Proof of Concept Payload

XSS[JaVaScriPt:alert(1)] <-- click to test

Thanks!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original