Cross-side scripting vulnerability in gitweb

Posted by wallunit on Friday December 17, 2010 @12:54PM
from the no-ack.org dept.

http://www.no-ack.org/2010/12/cross-side-scripting-vulnerability-in.html?sms_ss=hackernews&at_xt=4d0ba3dd94ff1509%2C0

( 4 comments | 2 points | on HN )

Re:Cross-side scripting vulnerability in gitweb by tptacek on Friday December 17, 2010 @12:57PM (#2017018)

I'm not super familiar with gitweb so I'll be the one to ask: what can you do with gitweb as a logged-in user? What's the impact of an XSS on gitweb?

[ Parent | on HN ]

Re:Cross-side scripting vulnerability in gitweb by wallunit on Friday December 17, 2010 @01:12PM (#2017077)

There is basically no login area. Gitweb is the official web interface for the source tracker git. If you have permissions to push to the repository the gitweb page is showing, you could possibly add a file to the repository, when shown on the page will inject malicious javascript code for example.

If you run gitweb for repositories where only yourself (an people you trust) has those permissions, this vulnerability is rather harmless. But if you are running gitweb for a large FOSS project with a lot of committers, you should be aware of that issue.

[ Parent | on HN ]

Re:Cross-side scripting vulnerability in gitweb by DupDetector on Friday December 17, 2010 @01:09PM (#2017069)

This seems to be a re-submission of a page by the same person:

http://news.ycombinator.com/item?id=2007597

Was this deliberate?

[ Parent | on HN ]

Re:Cross-side scripting vulnerability in gitweb by wccrawford on Friday December 17, 2010 @01:03PM (#2017037)

Site. Cross Site Scripting.

Would Cross Side Scripting come from the other side, beyond the grave? That would be quite a bit more serious.

[ Parent | on HN ]