XSS vulnerability in Framafoms
I just found another XSS vulnerability in Framaforms.
How to reproduce
- A malicious user creates a new form and with a markup field that contains
<img src=x onerror=alert(0)>and select one the following formats:
- A logged user visits the form of the attacker
- The JS payload is executed
This XSS is easily exploitable because it requires no user interaction.
Note: all the fields that allows the above markups are affected.
Note 2: The payload is also executed in the form editor. This means that an attacker can spread his/her attack using the shared models.
How to fix
- disable the formats
wysiwyg_userfor all the fields. The
Plain textseem to be ok.
- filter these formats to avoid XSS
I'm not sure if:
- this is an issue of Framaforms only
- this is an issue of webform
- this is an issue of Drupal or of another component used by Framaforms