{"action":"opened","issue":{"url":"https://api.github.com/repos/jappix/jappix/issues/579","repository_url":"https://api.github.com/repos/jappix/jappix","labels_url":"https://api.github.com/repos/jappix/jappix/issues/579/labels{/name}","comments_url":"https://api.github.com/repos/jappix/jappix/issues/579/comments","events_url":"https://api.github.com/repos/jappix/jappix/issues/579/events","html_url":"https://github.com/jappix/jappix/issues/579","id":156691737,"number":579,"title":"vulnerability","user":{"login":"Zeratyl06","id":19567341,"avatar_url":"https://avatars.githubusercontent.com/u/19567341?v=3","gravatar_id":"","url":"https://api.github.com/users/Zeratyl06","html_url":"https://github.com/Zeratyl06","followers_url":"https://api.github.com/users/Zeratyl06/followers","following_url":"https://api.github.com/users/Zeratyl06/following{/other_user}","gists_url":"https://api.github.com/users/Zeratyl06/gists{/gist_id}","starred_url":"https://api.github.com/users/Zeratyl06/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Zeratyl06/subscriptions","organizations_url":"https://api.github.com/users/Zeratyl06/orgs","repos_url":"https://api.github.com/users/Zeratyl06/repos","events_url":"https://api.github.com/users/Zeratyl06/events{/privacy}","received_events_url":"https://api.github.com/users/Zeratyl06/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-05-25T08:30:25Z","updated_at":"2016-05-25T08:30:25Z","closed_at":null,"body":"Hi. My company had a security audit. A vulnerability was discovered in Jappix, description below. I can hope on fixing it?\r\n\r\nCross-site scripting vulnerability in the web application XMPP client.\r\n\r\nThe vulnerability exists due to the lack of filtering of special characters of HTML markup when getting user data in HTTP response of the server. The vulnerability is mirrored in nature (the vector is passed in the HTTP package). An attacker using specially crafted request to inject malicious JavaScript/HTML code to the page the web applications. When you open such a page in the browser context of the targeted user, the attacker can gain access to important data or to perform actions on behalf of the user without his knowledge.\r\n\r\nRecommendations for Troubleshooting: to resolve this vulnerability, you want to filter custom data in vacancy_id parameter passed with the GET method through htmlspecialchars with the obligatory indication of the constant ENT_QUOTES as the second argument.\r\n\r\nExample: exploitation of this vulnerability is possible in the browser as Internet Explorer. To demonstrate the vulnerability, you could use the curl utility: curl “https://<your site>/?\\ \"><xss>”\r\nThe vector falls within the following page elements:\r\n\r\n`...\r\n51\r\n52 < div class = \"navigation\">\r\n53 < a class = \"homeimages mobile\" href = \"./?m=mobile&amp; \" >< xss > \"><span class=\" vert_center \">Mobile</span></a>\r\n54 < a class = \"homeimages manager\" href = \"./?m=manager&amp; \" >< xss > \"><span class=\" vert_center \">Manager</span></a>\r\n55 < a class = \"homeimages encrypted\" href = \"https://<your site>/? \" >< xss > \"><span class=\"vert_center \">Encrypted</span></a> </div>\r\n56 </ div>\r\n57 </ div>\r\n117 </ div>\r\n118\r\n119 < div class = \"locale\" data keepget= \"&amp; \" >< xss > \">\r\n120 < div class = \"current\">\r\n121 < div class = \"current_align\" > English </ div>\r\n...`"}}
{"actor":{"display_login":"Zeratyl06"}}