ckan/ckan — pull request #2085 by wardi (2014-11-27 17:54:16+00:00)
Title: XSS injection with the resource link

Just stumbled across https://github.com/okfn/ckanext-iati/issues/44 which was submitted (and fixed) for the IATI CKAN instance, but still seems to be vulnerable in CKAN core:

http://beta.ckan.org/dataset/btest-test/resource/ad19fe7f-570b-4e3a-bd6d-4ed18cb07e91

Currently the injected script alerts the document.cookie, but it could pass this content to a remote service, potentially giving an attacker admin access (if an Admin clicked on it).

This attack requires access to the dataset edit form.