Cross-site Scripting (XSS) - Stored in leantime/leantime

Valid

Reported on

Sep 2nd 2021

✍️ Description

A malicious actor is able to add new Milestone with a malicious payload, and upon opening the research menu, the XSS payload is being executed.

🕵️‍♂️ Proof of Concept

1; Log in with a proper roled user
2; Add a new Milestone to the system at the /tickets/roadmap URI with the + New Milestone button
3; Insert the following payload in the name field: <script>alert(document.cookie)</script>
4; Click on Milestones menu item on the left side of the site, and the xss payload is being executed

💥 Impact

With such opprotunity, the malicious actor is able to gather session identifiers from any users. Upon receiving this information, the Confidentiality, Integrity is compromised of the target's account.

We have contacted a member of the leantime team and are waiting to hear back 2 years ago

Marcel Folaron validated this vulnerability 2 years ago

TheLabda has been awarded the disclosure bounty

The fix bounty is now up for grabs

Marcel Folaron marked this as fixed in 2.1.9 with commit 6c97fd a year ago

Marcel Folaron has been awarded the fix bounty

This vulnerability will not receive a CVE

to join this conversation