Title : Stored XSS in Livefyre LiveComments Plugin
CVE : 2014-6420
Vendor Homepage : http://livefyre.com
Software Link : http://web.livefyre.com/streamhub/#liveComments
Version : v3.0
Author : Brij Kishore Mishra
Date : 03-Sept-2014
Tested On : Chrome 37, Ubuntu 14.04
Description :
This plugin requires user to be signed in via livefyre account to post
comments. Users have the option to upload pictures in comments. This
feature can be easily abused.
Using an intercepting proxy (e.g. Burp Suite), the name variable can be
edited to send an XSS payload while uploading a picture (payload used :
"><img src=x onerror=prompt(1337)>). When the comment is posted, the image
will be successfully uploaded, which leads to XSS due to an unsanitized
field.
