lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]

I might miss something but I think it doesn't matter much since:

- I don't think there is a way to construct a URL that runs this code.
- I don't think there is a login / session mechanism on so there isn't really a CSRF risk.

Pierre Chapuis

On Fri, Sep 13, 2019, at 08:54, Egor Skriptunoff wrote:
On Fri, Sep 13, 2019 at 5:06 AM Jonathan Burkett wrote:
Hello developers,
I've recently encountered a bug on the webpage. This allows for manipulation of webpage text through the Lua compiler. I ran the code: 
function a()
print(('Unnatural Lua Behavior\n'):rep(6))
This spams 'Unnatural Lua Behavior' to the output as well as overrides the message at the bottom with repetitions. This likely is open for the ability to run xss within the webpage body.
Hope y'all take care,

A similar "vulnerability" is the following:
a=setmetatable({}, {__gc = function() print('--><script>alert("Surprise!");</script>') end})
It has been reported 2 years ago, still not fixed