Cross-site Scripting (XSS) - Reflected in projectsend/projectsend

Valid

Reported on

Jul 2nd 2021


✍️ Description

GET parameter ?client= in Line 419 of manage-files.php sends unvalidated data to a web browser, which can result in the browser executing malicious code. In this case the data is sent at builtin_echo() in manage-files.php at line 419.

🕵️‍♂️ Proof of Concept

Data enters a web application through an untrusted source:

$this_id = $_GET['client'];

The data is included in dynamic content that is sent to a web user without being validated:

<?php
if (isset($search_on)) {
?>
<input type="hidden" name="modify_type" id="modify_type" value="<?php echo $search_on; ?>" />
<input type="hidden" name="modify_id" id="modify_id" value="<?php echo $this_id; ?>" />
<?php
}
?>

💥 Impact

The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data like cookies or other session information to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site.

We have contacted a member of the projectsend team and are waiting to hear back 3 months ago
Akshay Jain
2 months ago

Researcher


Hi Team, Any updates?

Ignacio Nelson validated this vulnerability 2 months ago
Akshay Jain has been awarded the disclosure bounty
The fix bounty is now up for grabs
Ignacio Nelson
2 months ago

Maintainer


Fixed on https://github.com/projectsend/projectsend/commit/cee4021f2aec53ea869d552e05494bf7718c81cf

Ignacio Nelson confirmed that a fix has been merged on cee402 2 months ago
Ignacio Nelson has been awarded the fix bounty