XSS vulnerability inside of file description

[GlowingUmbreon]

Upon creating or editing a file you can find an XSS method, this can be done by having two of the same URLs with a = inside of it next to each other with a newline between them like this:

https://www.lmms.io/property=value
https://www.lmms.io/property=value

This will cause issues in the way chrome renders it causing a possible XSS method, upon further research into this I made a few examples showing that this can be abused

execute javascript on mouse hover:

https://www.lmms.io/onmouseover=alert('test')//
https://www.lmms.io/onmouseover=alert('test')//

Change the colour of the text:

https://www.lmms.io/style=color:red/*
https://www.lmms.io/style=color:red/*

The comments for the languages at the end are required since a speech mark is added onto the end of the property by the website.

If you want to see these in action go to this link: Here
this vulnerability needs to be fixed to avoid people having cookies stolen, ips stolen etc.

This xss method was tested on: chrome, firefox, Internet explorer, Edge all of which have been tested and are vulnerable to this attack.

[tresf]

@UmbreonFR4 your link is broken. You have content=show, but it's action=show. I've fixed it.

[liushuyu]

Hi! Thanks for reporting the vulnerability!

The LSP website is very outdated and I knew there would be vulnerabilities (#281). However, I will try to fix this one.

[tresf]

@liushuyu it appears to be adding double HTML tags, and the browser is parsing the style info as a new HTML tag.

<a href="<a href="https://www.lmms.io/style=color:red/*" target=_blank >

I'm not sure how this is happening. First thought is an extra double-quote, but I'm not exactly sure yet.

[tresf]

The create_link function which I think is responsible but can't pinpoint it yet...

lmms.io/public/lsp/utils.php

Line 507 in 6d0a4f1

$html = '<a href="//' . $url . '" target=_blank >' . $url . '</a>';

[liushuyu]

@liushuyu it appears to be adding double HTML tags, and the browser is parsing the style info as a new HTML tag.

<a href="<a href="https://www.lmms.io/style=color:red/*" target=_blank >

I'm not sure how this is happening. First thought is an extra double-quote, but I'm not exactly sure yet.

This is due to an improper escaping done in utils.php in function parse_links.

[tresf]

This is due to an improper escaping done in utils.php in function parse_links.

That was my first thought too, but I don't see double quotes in the proof of concept description. If it's there, I can't find it.

[tresf]

@liushuyu I have a feeling that the HTML is being saved back into the database, then re-rendered.

[liushuyu]

@liushuyu I have a feeling that the HTML is being saved back into the database, then re-rendered.

No, it wasn't:

[tresf]

Hmm... something's adding the extra <a href, and I can't find it. You said on Discord you have a handle on it so I'll let you fix it.