Stored Cross-Site Scripting in Speed Optimizer Bundled HTML Minifier

Skrevet den af i Speed Optimizer

The bundled HTML minifier derived its placeholder token from an md5 of the request timestamp, which an attacker could predict, and used a loose pattern when matching quoted data URIs. Content crafted to contain a matching placeholder could survive minification and be injected into the cached page, executing script for unauthenticated visitors. The placeholder now uses random_bytes and the data URI pattern is anchored to its quotes.

This vulnerability affects the following application versions:

  • Speed Optimizer 7.6.4
  • Speed Optimizer 7.6.5
  • Speed Optimizer 7.6.6
  • Speed Optimizer 7.6.7
  • Speed Optimizer 7.6.8
  • Speed Optimizer 7.7.0
  • Speed Optimizer 7.7.1
  • Speed Optimizer 7.7.2
  • Speed Optimizer 7.7.3
  • Speed Optimizer 7.7.4
  • Speed Optimizer 7.7.5
  • Speed Optimizer 7.7.6
  • Speed Optimizer 7.7.7
  • Speed Optimizer 7.7.8