Redmine

Summary¶

There one one confirmed and several potential XSS vulnerabilities in
Redmine's flash rendering.

Description¶

When rendering flash messages, Redmine unconditionally marks the
rendered messages as html_safe. This leads to all html special
characters in the flash message to be rendered as HTML unless they are
manually escaped beforehand.

In several places in Redmine, the message is not sufficiently escaped
and allows the rendering of raw, user-supplied values.

Example exploit:

Given a user with the following string configured as the email address
(which is accepted by the mail validations):

"><script>alert('Vulnerable!')</script>"a@a.bc

When that user sends himself a test mail using the admin/test_mail
action, the configured email is pushed unescaped in the flash message,
resulting in the included javascript to be executed.

This can be used in a targeted attack as a reflected XSS to perform
actions as an administrator.

The attached patch also fixes other places where potentially unsafe
information is passed in a flash message, including an issue similar to
the one described above concerning mail registration.

This vulnerability is in Redmine since at least 2.3, possibly much
longer. It is advised to backport the patch to all supported versions of
Redmine and to release updated versions.

Credits¶

This issue was discovered by Holger Just of Planio.

Solution¶

Attach the patch against current Redmine trunk (redmine:r14014) attached to this
mail.