There is a storage xss vulnerability after you login in about anchor-cms HOT 7 CLOSED

"after you login", how can this be a vulnerability when you need to be logged in? Surely if you're logged in you're already vulnerable? 🤔

from anchor-cms.

Well if you think it's an issue you're welcome to contribute with a fix ✨

from anchor-cms.

Further, it was confirmed that no user could insert unescaped chars in #1102. Closing this unless there's a genuine vulnerability. If comments are sanitized, then it's not possible for someone to steal cookies?

from anchor-cms.

"after you login", how can this be a vulnerability when you need to be logged in? Surely if you're logged in you're already vulnerable?

This is a vulnerability in itself. I can insert a link of rebound cookie. which will be triggerd when the administrator or others . so that I can log in directly with the cookie.without the account password.

from anchor-cms.

This is a vulnerability in itself. I can insert a link of rebound cookie. which will be triggerd when the administrator or others [do what?]. so that I can log in directly with the cookie.without the account password.

So wouldn't the vulnerability be with the cookies? I'm no expert though. 🤷‍♂️ Nevermind, I was silly on this one. But still,

from anchor-cms.

Duplicate of #1298?

Anchor explicitly allows admins to use raw HTML in their pages. If a user was able to make a comment with XXS, then yes this would be a problem.

from anchor-cms.

Feel like this should be closed since, as @Gerrit0 has pointed out, it’s already been addressed in #1298. Anchor intentionally allows markup when entering content, it’s down to the user to take care when entering content

from anchor-cms.