{"action":"created","issue":{"url":"https://api.github.com/repos/kohana/kohana/issues/107","repository_url":"https://api.github.com/repos/kohana/kohana","labels_url":"https://api.github.com/repos/kohana/kohana/issues/107/labels{/name}","comments_url":"https://api.github.com/repos/kohana/kohana/issues/107/comments","events_url":"https://api.github.com/repos/kohana/kohana/issues/107/events","html_url":"https://github.com/kohana/kohana/issues/107","id":155558496,"number":107,"title":"Security::strip_image_tags bypass","user":{"login":"dsopas","id":11536578,"avatar_url":"https://avatars.githubusercontent.com/u/11536578?v=3","gravatar_id":"","url":"https://api.github.com/users/dsopas","html_url":"https://github.com/dsopas","followers_url":"https://api.github.com/users/dsopas/followers","following_url":"https://api.github.com/users/dsopas/following{/other_user}","gists_url":"https://api.github.com/users/dsopas/gists{/gist_id}","starred_url":"https://api.github.com/users/dsopas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dsopas/subscriptions","organizations_url":"https://api.github.com/users/dsopas/orgs","repos_url":"https://api.github.com/users/dsopas/repos","events_url":"https://api.github.com/users/dsopas/events{/privacy}","received_events_url":"https://api.github.com/users/dsopas/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":17,"created_at":"2016-05-18T17:29:05Z","updated_at":"2016-08-18T09:59:22Z","closed_at":"2016-08-18T08:49:14Z","body":"Hi,\r\n\r\nI found a security issue on your latest version. \r\nIn your security class – system/classes/Kohana/Security.php you have the following function to remove img tags from strings:\r\n\r\n```\r\n/**\r\n * Remove image tags from a string.\r\n *\r\n *     $str = Security::strip_image_tags($str);\r\n *\r\n * @param   string  $str    string to sanitize\r\n * @return  string\r\n */\r\npublic static function strip_image_tags($str)\r\n{\r\n\treturn preg_replace('#<img\\s.*?(?:src\\s*=\\s*[\"\\']?([^\"\\'<>\\s]*)[\"\\']?[^>]*)?>#is', '$1', $str);\r\n}\r\n```\r\n\r\nJust by looking at that regex it's possible to see that after <img it expects a space. So to bypass this you could use:\r\n\r\n<img/src...\r\n\r\nPHP example:\r\n\r\n```\r\n<?php\r\n$str = \"XSS de Imagem: <img/src=x onerror=prompt(document.domain)>\";\r\necho preg_replace('#<img\\s.*?(?:src\\s*=\\s*[\"\\']?([^\"\\'<>\\s]*)[\"\\']?[^>]*)?>#is', '$1', $str);\r\n```\r\n\r\nAnd it's still possible to inject a IMG on a string - in this case with a XSS vector.\r\nHope it helps.\r\n\r\nBest,\r\nDavid Sopas\r\nCheckmarx.com"},"comment":{"url":"https://api.github.com/repos/kohana/kohana/issues/comments/240678810","html_url":"https://github.com/kohana/kohana/issues/107#issuecomment-240678810","issue_url":"https://api.github.com/repos/kohana/kohana/issues/107","id":240678810,"user":{"login":"dsopas","id":11536578,"avatar_url":"https://avatars.githubusercontent.com/u/11536578?v=3","gravatar_id":"","url":"https://api.github.com/users/dsopas","html_url":"https://github.com/dsopas","followers_url":"https://api.github.com/users/dsopas/followers","following_url":"https://api.github.com/users/dsopas/following{/other_user}","gists_url":"https://api.github.com/users/dsopas/gists{/gist_id}","starred_url":"https://api.github.com/users/dsopas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dsopas/subscriptions","organizations_url":"https://api.github.com/users/dsopas/orgs","repos_url":"https://api.github.com/users/dsopas/repos","events_url":"https://api.github.com/users/dsopas/events{/privacy}","received_events_url":"https://api.github.com/users/dsopas/received_events","type":"User","site_admin":false},"created_at":"2016-08-18T09:59:22Z","updated_at":"2016-08-18T09:59:22Z","body":"No problem Samuel.\nNice work!\n\nBest,\n\n\nDavid Sopas\nhttps://twitter.com/dsopas\nhttps://www.linkedin.com/in/dsopas\n\nOn 18 August 2016 at 09:49, Samuel Demirdjian <notifications@github.com>\nwrote:\n\n> @dsopas <https://github.com/dsopas> this has been done. Thank you for\n> reporting this and sorry it took us so much time.\n>\n> —\n> You are receiving this because you were mentioned.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/kohana/kohana/issues/107#issuecomment-240662279>, or mute\n> the thread\n> <https://github.com/notifications/unsubscribe-auth/ALAIwpBnZ9nRX0CAr_mJ_lqRebwkox2tks5qhByRgaJpZM4IhhOf>\n> .\n>\n"}}
{"actor":{"display_login":"dsopas"}}