The "name" parameter of the award a badge functionality lacks any input validation

[sveeke]

threatLevel="Low" type="User input validation"

The "name" parameter of the award a badge functionality lacks any input validation:

Example request:

POST /v1/issuer/issuers/rwygWIDnR1uBB_i1MPwu_g/badges/XjAr-XCzRDyL7PxOJZSZqA/assertions HTTP/1.1
Host: badgr-dev2.edubadges.nl
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.04
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Token 5a29a471f3b21be11928361f5c42aeabf0c5cd8f
Content-Type: application/json
Referer: https://surf-dev2.edubadges.nl/issuer/issuers/rwygWIDnR1uBB_i1MPwu_g/badges/XjAr-XCzRDyL7PxOJZSZqA/issue
Content-Length: 442
Origin: https://surf-dev2.edubadges.nl
Connection: close

{"issuer":"rwygWIDnR1uBB_i1MPwu_g","badge_class":"XjAr-XCzRDyL7PxOJZSZqA","recipient_type":"email","recipient_identifier":"[email protected]","narrative":"","create_notification":true,"evidence_items":[],"extensions":{"extensions:recipientProfile":{"@context":"https://openbadgespec.org/extensions/recipientProfile/context.json","type":["Extension","extensions:RecipientProfile"],"name":"<script>alert('blaat');</script>Stefan"}}}

Response:

{
<KNIP>
  "extensions": {
    "extensions:recipientProfile": {
      "@context": "https://openbadgespec.org/extensions/recipientProfile/context.json",
      "type": [
        "Extension",
        "extensions:RecipientProfile"
      ],
      "name": "<script>alert('blaat');</script>Stefan"
    }
  },
<KNIP>

It did not result in a successful XSS as the content-type is application/json and not text/html. The contents of the name field seemed not to be requested at other places on the website that use text/html as the content-type and is also not send to the user in the confirmation e-mail.

impact:
Not validating the user input could result in issues such as XSS.

recommendation:
Filter all client-provided input parameters, and escape all output
Make use of a whitelist, and prevent certain characters from being inserted if it's not necessary for the working of the application.

[ottonomy]

👍 will fix.

[sveeke]

Just checking: has this been fixed @ottonomy ? :)

[ottonomy]

@sveeke Yes, a fix has been implemented.