2

I am hosting a static website (no PHP etc., just HTML/JavaScript/CSS) with a security-conscious hoster that proactively removes vulnerable files. This is fine with me.

However, their last report states many instances of the following issue, with various files:

...
Sicherheitslücke vom Typ "XSS" in WordPress
/home/..../website/mediaelement-4.2.9/lang/uk.js
...

With the following explanation:

XSS vulnerability in the Flash fallback files in MediaElement

An XSS vulnerability was discovered in the Flash fallback files in MediaElement, a library that was included with WordPress. Because the Flash files are no longer needed for most use cases, they have been removed from WordPress.

My question is, how can a JavaScript file cause an XSS vulnerability in a flash fallback file?

Note: This is a media player, not a form processor.

Note 2: The mention of WordPress is another issue, since this is not a WordPress installation, but this is not part of the question here.

Improve this question
1

1 Answer 1

Reset to default
1

Flash applications can run JavaScript code in the context of the page that they're embedded in. Flash objects can also take external input, e.g. via the URL or flash parameters, or through a scripting API via JavaScript.

Together, a vulnerable swf file can be used to perform XSS on the site that hosts the swf file. For example, see https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c

Based on your error message, I guess that the specific vulnerability was disclosed by this report: https://hackerone.com/reports/299112 (currently with limited visibility in the details). According to the report, the bug was reported 4 months ago. If you really want to know the exact details, you can look up the changes from the past four months at https://github.com/mediaelement/mediaelement

Improve this answer
3
  • Interestingly, my issue was reported on MediaElement version 4.2.9, which was released 7 days ago. According to the hackerone report, 4.2.8 already has the fix. Either this is a regression or hackerone has the numbers wrong.
    – Marcel
    Apr 4, 2018 at 8:47
  • @Rob_W This is the same report....
    – Marcel
    Apr 4, 2018 at 13:03
  • Really great explanation. Worth mentioning the XSF keyword here to aid further research if OP chooses to do so.
    – Cillian Collins
    Jul 27, 2018 at 16:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .