GitLab · Report #205497

[reStructuredText] XSS in project README files

Validstatus

mediumseverity

7upvotes

15 Feb 2017disclosed

Summary

Persistent XSS vulnerabilities were identified by way of the RubyDoc, reStructuredText, and Textile markup formats. Thanks again to the GitLab team. I've published a blogpost discussing my findings and the recent Security Release.

How it was found

Hi,

While experimenting with parser bypass techniques, I discovered that reStructuredText markup can be used to inject a stored JavaScript payload into a project README.rst file.

Steps to Reproduce

Create a new GitLab project
Initialise the project by creating a README file
Set the file title to README.rst
Paste the below Payload into the file
Commit the file to the project and click on the link

Proof of Concept Payload

`Security test link`__.

__ javascript:alert(document.domain)

Thanks!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original