Re: Re: New Include Redirect Bug XSS All vBulletin(r) v 3.x.x
I fully understand the significance of XSS and the numerous different ways to
get it on the server but this focuses directly on the ability to place a web
viewable document on the same domain which vBulletin doesn't provide itself.
What the author of this exploit has described is a way to influence a user to
visit a link to a crafted page already present on the domain, it isn't
traversing out of the directory, its only changing the value of a src or an
href parameter.
Short of removing the ability for users to provide links there isn't a way to
fix this, and even if we did they could just put the link on anyway and have
someone copy and paste.
In my eyes it isn't even an exploit at all, if you can create unsanitised
content that is web viewable then there is a more significant problem that
needs resolved and it out of our scope to fix.
Scott MacVicar