Skip to content
This repository has been archived by the owner on Apr 27, 2021. It is now read-only.

webrtc-from-chat potential XSS vulnerability, unfiltered data. #109

Open
hello-smile6 opened this issue Mar 5, 2021 · 1 comment
Open

Comments

@hello-smile6
Copy link

I was able to corrupt the user list for all users using the following script:

setInterval(function() {sendToServer({type:"userlist",users:["Hacked.","By helllo-smile6@github"]});,1);

Additionally, HTML entities can be used in the chat. HTML code is nullified. This may create additional, more secure vulnerabilities.

@escattone
Copy link
Contributor

@hello-smile6 Sorry for the delay in replying. Thanks for reporting this! We're planning to decommission this project eventually, but in the meantime, I'll pass this information on to our SRE team.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants