Bug Report: Stored HTML Injection
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- angular, typescript
Research direction
Start by reviewing the ticket comment rendering path in the Runbox 7 web app and trace how comment content is handled; the issue does not name files or tests. Reproduce the stored HTML injection with the supplied ticket comment payload, then verify that comments render safely and the link no longer redirects victims to an external site.
Written by the indexing model from the issue text.
Description
servity:- medium
https://github.com/user-attachments/assets/df5829e7-7771-4a67-8c89-c081e7545d1a
Bug Report: Stored HTML Injection
Description: Hello Team,
I discovered a vulnerability where an attacker can execute a stored HTML injection that leads to an open redirect. This issue allows a malicious user to exploit the application by redirecting victims to arbitrary, potentially harmful websites.
Steps to Reproduce:
Navigate to https://support.runbox.com/index.php?/Tickets/
create an ticket that contains html injection payload
Inject the following HTML code in a comment field: free_reward_is_here
Observe that the HTML injection is executed.and victim will be redirectd on evil.com
Impact: This vulnerability has significant security implications:
Phishing & XSS: The attacker can host a phishing page or an XSS attack on the redirected site, potentially compromising the victim's credentials or executing malicious scripts.
This vulnerability allows an attacker to craft a malicious link that, when clicked by a user, redirects them to an external site. This can be exploited to direct users to phishing sites, initiate XSS attacks, or serve other malicious content. The open redirect can be used as a vector to further compromise the user's security by leading them to harmful websites.
Website Defacement: The appearance of the page can be altered, potentially damaging the reputation of the website.
This issue poses a threat to users' security by exposing them to phishing attacks and other malicious activities. Please prioritize the investigation and mitigation of this
- Dominant language
- TypeScript
- Stars
- 132
- Forks
- 55
- Avg merge
- 6d 17h
- Merged PRs (30d)
- 1
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from runbox/runbox7
-
Names in Sent folderOpen
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Keep messages selected after an operation so a second operation can be performed on the same set.Possibly taken @gtandersen claimed this 10 days ago. Openenhancement
-
#2FA App passwords copy featurePossibly taken @hoanle0126 claimed this 22 days ago. Openenhancement P3-medium
Difficulty 2/5 1-3 hours Newbie friendliness 25/100
-
#Mail Initial index sync prompt hides message action iconsPossibly taken @LubuSeb claimed this 25 days ago. Openbug P1-urgent
Difficulty 2/5 1-3 hours Newbie friendliness 25/100
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
Similar issues
-
[analytics-core] getQueryParams does not decode `+` as space and truncates values containing `=`Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
amplitude/Amplitude-TypeScript#2179 · 1 comment ·
Maintainers usually reply within 2 days
-
ci good first issue severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
TMHSDigital/GH-Arcade#111 ·
-
AsnIntegerConverter.toASN coerces strings with +value, rounding integers outside safe-integer rangeOpen
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
PeculiarVentures/asn1-schema#189 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 4 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100