[CKAN-Security] HTML file upload issue

Ilja Pyykkönen ilja.pyykkonen at gofore.com
Wed Oct 15 11:37:59 UTC 2014

Dear CKAN,

  Seems that you can upload HTML files to CKAN and CKAN happily serves 
those files.


  This of course allows injecting scripts and using it in user context.

  There is commented code that would "fix" this issue, but it is not in use.


  This problem also occurs in resource preview.


  Also, seems that HttpOnly is not set for cookies either so you can use 
this method to steal users session.

Best regards,

More information about the Security mailing list