samples-server icon indicating copy to clipboard operation
samples-server copied to clipboard

webrtc-from-chat potential XSS vulnerability, unfiltered data.

Open hello-smile6 opened this issue 4 years ago • 1 comments

I was able to corrupt the user list for all users using the following script:

setInterval(function() {sendToServer({type:"userlist",users:["Hacked.","By helllo-smile6@github"]});,1);

Additionally, HTML entities can be used in the chat. HTML code is nullified. This may create additional, more secure vulnerabilities.

hello-smile6 avatar Mar 05 '21 17:03 hello-smile6

@hello-smile6 Sorry for the delay in replying. Thanks for reporting this! We're planning to decommission this project eventually, but in the meantime, I'll pass this information on to our SRE team.

escattone avatar Mar 11 '21 17:03 escattone