Summary
Event log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability.
Details
router.get(
"/:id",
isAdmin,
error_catcher(async (req, res) => {
const { id } = req.params;
const ev = await EventLog.findOneWithUser(id);
send_events_page({
[...]
contents: {
type: "card",
contents:
[...]
) +
div(
{ class: "eventpayload" },
ev.payload ? pre(JSON.stringify(ev.payload, null, 2)) : "" //<---
),
},
});
})PoC
The following PoC demonstrates how a non-admin user with permission to read/write on a table can inject malicious javascript code that will be executed in the event log admin panel if event logs are enabled.
To demonstrate this issue, we need to prepare some components. The following steps should be executed with an admin user.
- create a table with one column of type string set read/write permission to staff users (just as an example)
- visit
http://localhost:3000/table/new
- create a table with
Table name my_table_xss and click Create
- click
Add field to add a field with Label called payload of type String and click Next >>
- leave default values for
Attributes and click Next >> - it should redirect to http://localhost:3000/table/<table-number>
- under
Edit table properties, set Minimum role to read and Minimum role to write to staff
- create an edit view so that staff users can insert more data
- visit
http://localhost:3000/viewedit anc click Create View
- set the following values:
View name: my_xss_viewView pattern: EditTable: my_table_xssMinimum role: staff
- click
Configure >>
- on page
http://localhost:3000/viewedit/config/my_xss_view click Next >> and then Finish >>
- you should see a message
View my_xss_view saved
- edit the site structure to add the View just created so that
staff users can access it
- visit
http://localhost:3000/menu
- set the following values:
Type: ViewView: my_xss_view [Edit]Text label: viewMinimum role: staff
- click
Add
- create an event that will log when data is inserted in the
my_table_xss table create at step 1
- visit
http://localhost:3000/eventlog/settings
- under
Which events should be logged? select:
[X] Insert[X] Insert my_table_xss
Login with a user with staff role (you can do the same steps also with an admin user)
- visit
http://localhost:3000/view/my_xss_view
- in the
payload field insert "<svg/onload=alert(`xss`)> and click Save
With an admin user inspect the log entry generated by the above action:
- visit
http://localhost:3000/eventlog
- click on the event log generated (
http://localhost:3000/eventlog/<event-number>)
- an alert will appear
Impact
Stored Cross-Site Scripting (XSS)
Recommended Mitigation
Sanitize the user input before building HTML elements
References
dellalibera Reporter
Summary
Event log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability.
Details
PoC
The following PoC demonstrates how a non-admin user with permission to read/write on a table can inject malicious javascript code that will be executed in the event log admin panel if event logs are enabled.
To demonstrate this issue, we need to prepare some components. The following steps should be executed with an admin user.
http://localhost:3000/table/newTable namemy_table_xssand clickCreateAdd fieldto add a field withLabelcalledpayloadof typeStringand clickNext >>Attributesand clickNext >>- it should redirect tohttp://localhost:3000/table/<table-number>Edit table properties, setMinimum role to readandMinimum role to writetostaffhttp://localhost:3000/vieweditanc clickCreate ViewView name:my_xss_viewView pattern:EditTable:my_table_xssMinimum role:staffConfigure >>http://localhost:3000/viewedit/config/my_xss_viewclickNext >>and thenFinish >>View my_xss_view savedstaffusers can access ithttp://localhost:3000/menuType:ViewView:my_xss_view [Edit]Text label:viewMinimum role:staffAddmy_table_xsstable create at step 1http://localhost:3000/eventlog/settingsWhich events should be logged?select:[X] Insert[X] Insert my_table_xssLogin with a user with staff role (you can do the same steps also with an admin user)
http://localhost:3000/view/my_xss_viewpayloadfield insert"<svg/onload=alert(`xss`)>and clickSaveWith an admin user inspect the log entry generated by the above action:
http://localhost:3000/eventloghttp://localhost:3000/eventlog/<event-number>)Impact
Stored Cross-Site Scripting (XSS)
Recommended Mitigation
Sanitize the user input before building HTML elements
References