We used chatbot code from IBM, and it was instantly vulnerable to XSS attacks

#1

Post by ftreml » Tue, Feb 02, 2021, 4:44 PM UTC

We used chatbot code from IBM, and it was instantly vulnerable to XSS attacks
github.com

Re: We used chatbot code from IBM, and it was instantly vulnerable to XSS attacks

#2

Post by ftreml » Tue, Feb 02, 2021, 4:45 PM UTC

I wrote about security threats for chatbots

https://floriantreml.medium.com/security-threats-and-securit...

Re: We used chatbot code from IBM, and it was instantly vulnerable to XSS attacks

#3

Post by lumpa » Tue, Feb 02, 2021, 5:14 PM UTC

The repo reads like research code, and indeed seems to be an article's companion code plus platform example code. The code in question was committed in 2018 and never touched again.

That's no excuse, it pretty literally does "innerhtml = user_input" and it's awful. But it's not a flagship chatbot library from what I see, which probably lessens the impact of such awfulness.

Re: We used chatbot code from IBM, and it was instantly vulnerable to XSS attacks

#4

Post by ftreml » Tue, Feb 02, 2021, 5:27 PM UTC

lumpa wrote: post #3

The repo reads like research code, and indeed seems to be an article's companion code plus platform example code. The code in question was committed in 2018 and never touched again. That's no excuse, it pretty literally does "innerhtml = user_input" and it's awful. But it's not a flagship chatbot library from what I see, which probably lessens the impact of such awfulness.

partially agree. In another repo, the same vulnerability was only fixed after years ...

https://github.com/watson-developer-cloud/assistant-simple/c...