Stored XSS in Livefyre LiveComments Plugin

vendor:

Livefyre LiveComments Plugin

by:

Brij Kishore Mishra

8,8

CVSS

HIGH

Stored XSS

CWE

Product Name: Livefyre LiveComments Plugin

Affected Version From: v3.0

Affected Version To: v3.0

Patch Exists: YES

Related CWE: 2014-6420

CPE: a:livefyre:livefyre_livecomments_plugin

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Chrome 37, Ubuntu 14.04

2014

Stored XSS in Livefyre LiveComments Plugin

This plugin requires user to be signed in via livefyre account to post comments. Users have the option to upload pictures in comments. This feature can be easily abused. Using an intercepting proxy (e.g. Burp Suite), the name variable can be edited to send an XSS payload while uploading a picture (payload used : "><img src=x onerror=prompt(1337)>). When the comment is posted, the image will be successfully uploaded, which leads to XSS due to an unsanitized field.

Mitigation:

Input validation and output encoding should be used to prevent XSS attacks.

Source

Exploit-DB raw data:

Title : Stored XSS in Livefyre LiveComments Plugin
CVE : 2014-6420
Vendor Homepage : http://livefyre.com
Software Link : http://web.livefyre.com/streamhub/#liveComments
Version : v3.0
Author : Brij Kishore Mishra
Date : 03-Sept-2014
Tested On : Chrome 37, Ubuntu 14.04


Description :

This plugin requires user to be signed in via livefyre account to post
comments. Users have the option to upload pictures in comments. This
feature can be easily abused.

Using an intercepting proxy (e.g. Burp Suite), the name variable can be
edited to send an XSS payload while uploading a picture (payload used :
"><img src=x onerror=prompt(1337)>). When the comment is posted, the image
will be successfully uploaded, which leads to XSS due to an unsanitized
field.