Not a bug IMG tag

[topkurs2]

Affected version

2.2.8

Hello.
Just found some small, but unpleasant bug or feature?
When using IMG tag, manually we can add in this tag any url, any info, not only image.
I mean

[img]http://google.com[/img]

or

[img]http://127.0.0.1[/img]

All these tags are parsing by Xenforo in such way:

It's very unsecure. This opens the possibility for attacks, phishing, disclosure of IP address, browser, refer and so on.
I suggest to add some verification procedure - to check is this real image (e.g. by file extensions). or not. If not - do not parse it. Such system was in Vbulletin (I don't remember by default or in addon).

 

[Old Nick]

But the broken image icon seems to be not clickable. So where is the danger ?

 

[topkurs2]

But the broken image icon seems to be not clickable. So where is the danger ?

By this broken url we can know a lot of info. It's unsafe and unsecure.
For example, quick example. Xenforo.com is using Cloudflare.

ping xenforo.com
xenforo.com [172.67.1.198]

We can simply know in 3 seconds real backend of xenforo.com

74.207.234.23
PTR mailer.xenforo.com
useragent XenForo/2.x (https://xenforo.com/community)

It's the simplest example.

 

[Jeremy P]

When using IMG tag, manually we can add in this tag any url, any info, not only image.

Any URL can respond to a request with an image. It's not possible to determine ahead of time.

By this broken url we can know a lot of info. It's unsafe and unsecure.

It's not any different from someone uploading an image to a web server under their control and embedding it. They would get the same information. This is largely mitigated by using the image proxy anyway.

We can simply know in 3 seconds real backend of xenforo.com

You can configure a proxy to avoid this. External requests (those from the image proxy among them) will go through the proxy instead.

 

[Chris D]

You can configure a proxy to avoid this. External requests (those from the image proxy among them) will go through the proxy instead.

As is the case here. All you’ve revealed is our proxy IP address.