artesaos/seotools

XSS in canonical tag.

vdvcoder opened this issue · 2 comments

vdvcoder commented

What steps will reproduce the problem?

  1. Setting the canonical config to null (using Url::current())

  2. Capture a post request with burpsuite.

  3. Send the post request to repeator.

  4. Change the POST URI to:
    POST /<redacted>/<redacted>/<redacted>/<redacted>/deelnemen'"><svg/onload=alert()>

  5. Send the request.

What is the expected result?

<link rel="canonical" href="https://<redacted>.<redacted>/<redacted>/<redacted>/<redacted>/<redacted>/deelnemen'&quot;&gt;&lt;svg/onload=alert()&gt;"/>

What do you get instead?

<link rel="canonical" href="https://<redacted>.<redacted>/<redacted>/<redacted>/<redacted>/<redacted>/deelnemen'"><svg/onload=alert()>"/>

Payload triggers.

Additional info

How to solve:
vendor/artesaos/seotools/src/SEOTools/SEOMeta.php

Line: 475
return $this->canonical ?: (($canonical_config === null) ? app('url')->full() : $canonical_config);

Change into:

return $this->canonical ?: (($canonical_config === null) ? htmlspecialchars(app('url')->current()) : $canonical_config);

NOTE: Also look for other places where you call ap('url')->current() to sanitize the input.

Q A
This Package Version 0.19.1
Laravel Framework Version 8.32.1
PHP version 7.4
Operating system Mac OS Big Sur
SAEIIID commented

i use seotools for Laravel but not ideal performance :(

  • 👎1
J-Brk commented

i use seotools for Laravel but not ideal performance :(

This has nothing to do with XSS. It would be good to review your own code if you're having bad performance.

If there is any specific issue your having with the package, feel free to open an issue.