Address cross-site scripting vulnerabilities

[pablo]

From Phil:

There are multiple XSS vulnerabilities in the JW Player:

The first two instances were previously known and "fixed" with a custom ActionScript function "cleanLink":

        public static function cleanLink(arg0:String) : String
        {
            return arg0.replace(new RegExp("^(javascript|asfunction|vbscript)\\:"), "");
            
        }

This function does not adequately protect against XSS because it will only remove the first instance of the text "javascript:" from a URL. A URL like "javascript:javascript:alert(1)" will be "cleaned" to "javascript:alert(1)".

The other three instances of cross-site scripting vulnerabilities do not appear to be publicly known at this time.

1. JW Player "link" parameter: Load  the URL and click anywhere in the window.
2. JW Player "logo.link" parameter in licensed versions of JW Player: Load  the URL and click on the logo in the top-left
3. JW Player "aboutlink" parameter: Load  the URL and right-click on the flash application. Choose "getXSSed!" from the menu

[pablo]

Fixed in [2146]

[pablo]

Milestone Player 5.9 Patch 1 deleted

[pablo]

Added an additional check for casing (i.e. "JavaScript:" instead of "javascript:") in [2159]

[pablo]

If debug parameter is set to a javascript function, the player will  execute it.

[pablo]

If something like javajavascript:script: appears, the replacement only occurs once. Reported by Ali Pezeshk of Microsoft and Microsoft Vulnerability Research (MSVR)

[pablo]

Resolved in [2206]

[pablo]

Reported by Soroush Dalili (@irsdl, SecProject.com):

Firefox has a vulnerability where a request with the "feed:" prefix will execute any javascript contained within.

 example (Firefox only)

Fixed in [2274]

[pablo]

Also pointed out by Soroush Dalili:

New fix can also be bypassed by:  http://developer.longtailvideo.com/trac/testing?file=feefeed:d:javascript:alert%281%29;//@irsdl.mp4&autostart=true

Fixed in [2292]

[pablo]

In the commercial player, it's possible to use logo.link with base64-encoded HTML to inject javascript (Firefox only):

http://site/jwplayer.swf?file=1.flv&logo.file=1.jpg&logo.link=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B

The aboutlink parameter also suffers from this vulnerability.

Fixed in [2393]

[pablo]

Milestone Player 5.11 deleted