Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Valid

Reported on

Dec 18th 2021


Description

XSS in Classification Store (included panels like Collections, Groups, Key,... in the store)

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

Proof of Concept

1. Go to Settings > Data Objects > Classification Store

2. Add an item with XSS payload in the name field.

3. XSS will triggered when reload the page.

Impact

XSS can have huge implications for a web application and its users. User accounts can be hijacked, change the html screen and insult the organization. Credentials could be stolen, sensitive data could be exfiltrated, and lastly, access to your client computers can be obtained.

We are processing your report and will contact the pimcore team within 24 hours. a year ago
We have contacted a member of the pimcore team and are waiting to hear back a year ago
Divesh Pahuja validated this vulnerability a year ago
laladee has been awarded the disclosure bounty
The fix bounty is now up for grabs
Divesh Pahuja marked this as fixed in 10.2.7 with commit d5c3e8 a year ago
Divesh Pahuja has been awarded the fix bounty
This vulnerability will not receive a CVE
groupsPanel.js#L122-L123 has been validated
to join this conversation