Cross-site Scripting (XSS) - Stored in yogeshojha/rengine


Reported on

Aug 29th 2021

✍️ Description

'Delete Scheduled Task' confirmation model executes javascript as part of the name of a scan engine.

🕵️‍♂️ Proof of Concept

  1. Name a scan engine as a XSS payload. Example: <img src=x onerror=confirm(document.domain)>
  2. Schedule a scan for any target using the created scan engine.
  3. Try to delete the scheduled task


📍 Location rengine#L1


We have contacted a member of the yogeshojha/rengine team and are waiting to hear back 2 years ago
Niraj Khatiwada modified the report
2 years ago
Yogesh Ojha
2 years ago


Thank you for reporting this. And again Congratulations on your bounty.

Yogesh Ojha
2 years ago


The fix is on the way, I had to remove the verbose message, the scan engine name was being passed as a parameter to JS function, which could be easily bypassed using ' or ` or ) chars. I guess it is wise to remove that param.

Yogesh Ojha marked this as fixed with commit f21e83 2 years ago
Yogesh Ojha has been awarded the fix bounty
This vulnerability will not receive a CVE
Yogesh Ojha
2 years ago


Not sure why you haven't been awarded here. I hope the admin resolves this.

Thank you @nerrorsec once again for helping reNgine secure.

Niraj Khatiwada
2 years ago


Pleased to be of assistance ( ᵔ ͜  ᵔ )

Jamie Slome
2 years ago


@Yogesh - we have still rewarded the researcher. Whether you confirm the fix, or mark the vulnerability as valid, all rewards are still given.

to join this conversation