Stored Cross-Site Scripting in Map Share Page

Summary

In June 2015, @hussain found a stored cross-site scripting (XSS) vulnerability in the share page of our v3 and v4 Mapbox classic maps. This vulnerability did not affect mapbox.js, Mapbox GL JS, or any of our mobile SDKs, it only affected the share page for v3 and v4 maps hosted on *.tiles.mapbox.com. In order to be subject to the XSS attack, a user had to either directly visit the share URL of a malicious map or visit an attacker-controlled web page with a malicious map embedded via an iframe.

Hussain created a map in the online classic map editor and added several XSS payloads to a few map markers.

The payload <img src=x onerror=alert(1) " evaded sanitization and executed arbitrary JavaScript immediately. The payload was added to the DOM as part of a list of map marker titles in the top left hand corner of the share page.

The following old code in https://a.tiles.mapbox.com/v3/embed/share.js and https://a.tiles.mapbox.com/v4/embed/share.js was vulnerable:

function stripHTML(html) {
   var tmp = document.createElement('DIV');
   tmp.innerHTML = L.mapbox.sanitize(html);
   return tmp.textContent || tmp.innerText || '';
}

The stripHTML function returned <img src=x onerror=alert(1) " due to the use of textContent, which converted the < HTML entity into the left angle bracket unicode character (<). As a result, the payload was added to the share page as <img src=x onerror=alert(1) ", executing alert(1) on error when loading the image with no source.

We resolved the issue by using underscore's escape function before returning the textContent of the marker.

function stripHTML(html) {
   var tmp = document.createElement('DIV');
   tmp.innerHTML = L.mapbox.sanitize(html);
   return _.escape(tmp.textContent || tmp.innerText || '');
}

As seen in this map, the map marker title is <img src=x onerror=alert(1)" now instead of a broken image tag.