Link Injection

[Rob_Ammerlaan]

I am requesting support regarding the implementation of the Marketo forms at our WordPress website. On the following pages:

https://www.backbase.com/resources/request-live-demo-2-2/

https://connect.backbase.com/registration-2019

The user can do Link Injection. This results in a unsafe way of working. Please let me know how we can proceed in preventing this from happening. We use the code from the Marketo website 1 on 1 as suggested in the backend. 

I hope you can help me as soon as possible,

[Rob_Ammerlaan]

Hi Sandford,

Currently, we are not escaping the user input in the field we use in the auto responder email. Can you tell me how that works?

The email I am talking about now is specifically: 

https://app-lon06.marketo.com/#EM4171A1LA1 

I hope you can help us, 

[SanfordWhiteman]

Currently, we are not escaping the user input in the field we use in the auto responder email. Can you tell me how that works?

It’s in my blog above. Also see https://nation.marketo.com/community/product_and_support/blog/2019/09/17/even-when-velocity-isn-t-do... 

[SanfordWhiteman]

Your point is rather vague. Are you using unfiltered, unescaped user input in an auto-responder email? Or on an LP?

I wrote about these concerns a scary number of years ago: https://blog.teknkl.com/tokens-as-hacker-weapons-1/