Marshall Hallenbeck Marshall-Hallenbeck
Marshall-Hallenbeck
/ opentrade_0.2.0_domxss_disclosure_1-10-2020
Last active
January 13, 2020 14:37
OpenTrade Dom-Based XSS Disclosure
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [Vulnerability Description] | |
| OpenTrade through version 0.2.0 has a Dom-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains Javascript. | |
| [Application Description] | |
| OpenTrade is an open source crypto currency exchange that can support over a dozen cryptocurrencies. Its live version can be found at https://trade.multicoins.org. | |
| [Affected Versions] | |
| The following commit introduced the vulnerability, but OpenTrade did not have a package.json with applicable versioning: https://github.com/3s3s/opentrade/commit/731459452c8e476cb30fcf84ef0d05d153aba0ed#diff-910e51c56f379da78d78892e221e692aR417 | |
| Officially version 0.2.0 of OpenTrade is the only "vulnerable" version, as it is the first committed version number in package.json |
NewerOlder