Mozilla · Report #3175695
Bypass "No Links" Restriction in Biography via Protocol-Relative URL (//)
Summary
The report identifies an issue in the biography field on addons.allizom.org where the application's restriction on using links can be bypassed using protocol-relative URLs. Despite the explicit policy against links, users can embed functional hyperlinks using the syntax <a href="//evil.com">click</a>, which successfully creates clickable links that redirect to external websites.
The restriction on using links is mainly to avoid spam and not necessarily a security control, therefore, the severity of bypassing the restriction is low.
How it was found
Summary:
The application claims to disallow hyperlinks in the Biography field with the notice:
Links are forbidden.
However, it is possible to bypass this restriction using a protocol-relative URL (//evil.com) in an <a> tag. This allows an attacker to embed external links despite the stated limitation, violating trust and posing security risks.
Steps To Reproduce:
- Log in to the website
https://addons.allizom.org - Click on
edit profile
{F4409242}
- In the
Biographyfield, there will be a warning thatSome HTML supported: <abbr title> <acronym title> <b> <blockquote> <code> <em> <i> <li> <ol> <strong> <ul>. Links are forbidden.
{F4409247}
- Now, we add the <a> tag
payload: <a href="//evil.com">click</a>
{F4409262}
- Check that this <a> tag is executed. and when clicking on
clickwill redirect to the pagehttp://evil.com/{F4409264}
{F4409267}
Impact
- Violates declared application policy: users trust that links are not allowed.
- Enables attackers to embed links to:
- Phishing sites.
- Malware downloads.
- Social engineering payloads.