Cross-site Scripting (XSS) - Stored in yogeshojha/rengine
Reported on
Aug 29th 2021
✍️ Description
'Delete Scheduled Task' confirmation model executes javascript as part of the name of a scan engine.
🕵️♂️ Proof of Concept
- Name a scan engine as a XSS payload. Example: <img src=x onerror=confirm(document.domain)>
- Schedule a scan for any target using the created scan engine.
- Try to delete the scheduled task
Location
https://github.com/yogeshojha/rengine/blob/master/web/static/custom/custom.js#L43
📍 Location rengine#L1
Occurrences
Thank you for reporting this. And again Congratulations on your bounty.
The fix is on the way, I had to remove the verbose message, the scan engine name was being passed as a parameter to JS function, which could be easily bypassed using ' or ` or ) chars. I guess it is wise to remove that param.
Not sure why you haven't been awarded here. I hope the admin resolves this.
Thank you @nerrorsec once again for helping reNgine secure.
@Yogesh - we have still rewarded the researcher. Whether you confirm the fix, or mark the vulnerability as valid, all rewards are still given.