TruthMedia/FormBuilder-Development — pull request #40 by tommarshall (2012-05-28 15:38:22+00:00)
Title: Resolved XSS vulnerability with the referer functionality (REVISED)

Hi Guys,

It's currently possible to inject JS into a page that is displaying a form created by the FormBuilder plugin by parsing in malicious code in the Referer HTTP header.

The value of the Referer HTTP header is copied into the value of a hidden HTML tag attribute which is encapsulated in single quotation marks, without any filtering.

HTTP Request:

GET /contact-us/ HTTP/1.1
Host: www.example.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18
(KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Connection: close
Referer: http://www.google.com/search?hl=en&q=94a77'>something

(Just need to add the Referer line to test)

Results in the following in the markup:

something' />

HTTP_REFERER is a pretty tough XSS vector for an attacker to leverage, but this can be easily mitigated by filtering the value with htmlspecialchars.

Thanks for the plugin,
Tom