Stored Cross-Site Scripting in SiteSEO Noreferrer Link Rewriting

Skrevet den af i SiteSEO – SEO Simplified

A regular expression intended to strip the noreferrer value from link rel attributes matched the whole opening anchor tag and replaced it with a bare tag, discarding the remaining attributes and leaving malformed markup in post content. Crafted link markup could break out of the tag and execute script for anyone viewing the post. The expression now removes only the noreferrer token and leaves the rest of the tag intact.

This vulnerability affects the following application versions:

  • SiteSEO – SEO Simplified 1.1.5
  • SiteSEO – SEO Simplified 1.1.6
  • SiteSEO – SEO Simplified 1.1.8
  • SiteSEO – SEO Simplified 1.1.9
  • SiteSEO – SEO Simplified 1.2.0
  • SiteSEO – SEO Simplified 1.2.1
  • SiteSEO – SEO Simplified 1.2.2
  • SiteSEO – SEO Simplified 1.2.3
  • SiteSEO – SEO Simplified 1.2.4
  • SiteSEO – SEO Simplified 1.2.5
  • SiteSEO – SEO Simplified 1.2.6
  • SiteSEO – SEO Simplified 1.2.7