smarty_function_mailto - JavaScript injection in eval function

[iricartb]

I found a bug in the Smarty package, specifically in the smarty_function_mailto($params) function.

Remote exploitation of such vulnerability is unlikely, but it is still advisable to take it into account.

A web page that uses this function and that could be parameterized using GET or POST input parameters could cause the injection of JavaScript code of a malicious user and cause cross-site scripting attacks.

Using the following code you can inject JavaScript code into the smarty_function_mailto function.

===============================================================

$params = array(
'encode'=>'javascript',
'address'=>'iricartb@gmail.com">iricartb@gmail.com'); alert("- JavaScript Injected -"); //',
);

echo smarty_function_mailto($params);

===============================================================

[wisskid]

Definitely a security risk, esp when users on a website can provide their own mail address in a profile for example. And there's an issue with html escaping not being done too. See:

<?php

require('libs/Smarty.class.php');

$tpl = new Smarty();
$tpl->assign("htmladdress", 'iricartb@gmail.com"><h1>');
$tpl->assign("jsaddress", 'iricartb@gmail.com">iricartb@gmail.com\'); alert("- JavaScript Injected -"); //');

file_put_contents("output.html", $tpl->fetch('page1.tpl'));

page1.tpl

{mailto address=$htmladdress}
{mailto address=$jsaddress encode=javascript}

then open output.html in your browser. Choosing iricartb@gmail.com"><h1> as your mail address will change page layout by injecting a h1. This applies to the text param as well.

[wisskid]

Savvy Smarty users might have circumvented this bug by doing {mailto address=$htmladdress|escape} and it will not be possible to detect this, which might cause double escaping. We should probably warn for this in the release notes.

[grahamperrin]

Cross reference:

• CVE-2018-25047 : In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_f