Skip to content

Instantly share code, notes, and snippets.

@paatui

paatui/README.md

Last active January 3, 2024 15:40
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save paatui/a3c7ca8cf12594b437d3854f13d76cb8 to your computer and use it in GitHub Desktop.
Save paatui/a3c7ca8cf12594b437d3854f13d76cb8 to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2020-18327
Raw
README.md

Alfresco Community Edition v5.2.0 – Reflected XSS vulnerability in Administration Console

Description

Alfresco is a collection of information management software products for Microsoft Windows and Unix-like operating systems developed by Alfresco Software Inc. using Java technology.

Reflected Cross Site Scripting (XSS) vulnerability exists in Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API, which allows a remote attacker to inject arbitrary JavaScript.

Date: 03 March 2022
Software Link: https://www.alfresco.com
Exploit Author: Chakrit Sangsakul, Pongpol Phaiaroonrut, Thanavit Chongsutakawewong
CVE: CVE-2020-18327
Category: Web Application

Proof of Concept

  1. Access to Alfresco Administration Console.
  2. Navigate to “Node Browser” function in “Support Tools” and querying the Node browser by pressing the “Execute” button.
  3. Inject JavaScript into “action” parameter.

CVE-2020-18327_01 CVE-2020-18327_02 CVE-2020-18327_03

Timeline

Discovery and report : 24 June 2019
CVE ID was assigned : 11 Aug 2021
Public : 3 March 2022

Solution

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment