Stored XSS in neorazorx/facturascripts
Reported on
May 18th 2022
Description
Stored XSS in ListAgenciaTransporte module in facturascripts is triggered when clicking the scrolling middle mouse button.
Proof of Concept
1.Create a new non-admin account
2.Login and goto http://localhost/invoices/EditAgenciaTransporte
3.Add new user with website link to javascript:confirm(document.domain)
4.Save user and navigate to http://localhost/invoices/ and click on the website link of newly created user by using the scrolling middle mouse button.
Note
I see that there is a fix with this xss vulnerability by clicking the left mouse button here (https://huntr.dev/bounties/31aba7c9-edcf-44bf-9fd8-ca15d1fa53c8/) but in this report, I can trick it by clicking the middle mouse button.
Impact
This vulnerability has the potential to phish user to another page and trick user to steal cookies and gain unauthorized access to that user's account through the stolen cookies.
This bug was fixed here https://huntr.dev/bounties/31aba7c9-edcf-44bf-9fd8-ca15d1fa53c8/
Hi @maintainer,
This bug is not the same as in the other report https://huntr.dev/bounties/31aba7c9-edcf-44bf-9fd8-ca15d1fa53c8/ which use the left button mouse to click on the link.
Although the bug is stored XSS at the same place, the way to exploit it is different.
In my report, to exploit the bug, you must click on the link by using the middle scrolling button mouse. I have tested it on the newest release which is 2022.08 and it is still vulnerable.
You can read the reference in my report to know more about this technique, it's a type of bypass your fix in the previous report. (http://blog.dclabs.com.br/2021/05/the-curious-case-of-xss-and-mouse.html)
I hope that you will review it again, thank you!
I was unable to save javascript:confirm(document.domain) as url after the patch. But in case you had already saved them before the patch, with this other patch the link will not be generated when displaying the data -> https://github.com/NeoRazorX/facturascripts/commit/f3f8d437d55709eb61ef40677b9a9103fd18a953
I don't know how to proceed in these cases. It won't let me mark as valid anymore.
Hi @admin, can you help the maintainer to edit the status of this report from duplicate to valid as he mentioned in the above comment?
Many thanks!
@neorazorx - I have re-opened the report for you 👍 Feel free to update the report as you see fit :)