Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore

Valid

Reported on

Jan 6th 2022

Description

The application does not escape special characters before output to FE, lead to stored XSS.

Proof of Concept

Example of a case:

  1. Go to Content > Content Types /Admin/ContentTypes/List

  2. Create or edit a type with XSS payload into Display Name field, e.g: Social Meta Settings </title><svg/onload=alert('hacked')><title>

Tick on the Creatable checkbox

  1. Save and go to create new Type which edited above or go to Content > Content Items. Script will triggered

Impact

XSS can have huge implications for a web application and its users. User accounts can be hijacked, change the html screen and insult the organization. Credentials could be stolen, sensitive data could be exfiltrated, and lastly, access to your client computers can be obtained.

We are processing your report and will contact the orchardcms/orchardcore team within 24 hours. a year ago
We created a GitHub Issue asking the maintainers to create a SECURITY.md a year ago
We have contacted a member of the orchardcms/orchardcore team and are waiting to hear back a year ago
A orchardcms/orchardcore maintainer validated this vulnerability a year ago
laladee has been awarded the disclosure bounty
The fix bounty is now up for grabs
A orchardcms/orchardcore maintainer marked this as fixed in 1.2.1 with commit 4da927 a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
Hello.cshtml#L25 has been validated
Index.cshtml#L54 has been validated
laladee
a year ago

Researcher

@maintainer your patch has not patched all locations. For example in the Workflows section, maybe I'll try to list them all in the next report

to join this conversation