Possible XSS Vulnerability

[jamesmehorter]

Type of issue

Possible XSS security vulnerability.

Description

After generating Prebid.js (using gulp), line 376 (in Prebix v0.21.0)

url, width, and height parameters should be added using DOM manipulator functions, otherwise it might be XSS vulnerable

doc.write('<IFRAME SRC="' + url + '" FRAMEBORDER="0" SCROLLING="no" MARGINHEIGHT="0" MARGINWIDTH="0" TOPMARGIN="0" LEFTMARGIN="0" ALLOWTRANSPARENCY="true" WIDTH="' + width + '" HEIGHT="' + height + '"></IFRAME>');

Steps to reproduce

Generate prebid.js using:
gulp serve --adapters /path/to/my/vendors.json

This is my vendors.json

[
    "appnexus",
    "indexExchange",
    "pubmatic",
    "rubicon",
    "sovrn",
    "triplelift",
    "centro",
    "sharethrough",
    {
      "rubicon": {
        "alias": "rubiconLite",
        "supportedMediaTypes": ["video"]
      }
    }
]

Expected results

Any generated HTML should use DOM manipulator functions instead of arbitrarily building a string of HTML, e.g. something like..

var iframe = document.createElement('iframe');
iframe.src = encodeURI(url);
iframe.width = width;
iframe.height = height;
...

Actual results

doc.write('<IFRAME SRC="' + url + '" FRAMEBORDER="0" SCROLLING="no" MARGINHEIGHT="0" MARGINWIDTH="0" TOPMARGIN="0" LEFTMARGIN="0" ALLOWTRANSPARENCY="true" WIDTH="' + width + '" HEIGHT="' + height + '"></IFRAME>');

Platform details

Prebid v0.21.0
Generating with OS X 10.12.4
NPM v3.10.8

Other information

None

[mkendall07]

@jamesmehorter
Thanks for the issue report. Can you explain how this would get exploited? I assume that in order to do this, the adapter would have to be compromised to pass in and carry the exploit. If so the risk is minimal, but still possible. Is that what you are thinking about? Feel free to submit a PR with the suggested changes.

[jamesmehorter]

If for any reason adObject became compromised, the current implementation could potentially let in something like <iframe src="javascript:alert('haxxord');" ...>

That's doubtful, but better safe than sorry. This doc presents it a little better than I can: https://www.mediawiki.org/wiki/DOM-based_XSS

Not sure I'll be able to submit a PR—is that line generated by src/prebid.js:315 ?

[mkendall07]

@jamesmehorter
Yes that's correct - the code is at src/prebid.js:315