Description

Rengine supports automatic vulnerability reporting to hackerone the module included a feature to customize the report using a markdown editor. Although it was blocking some malicious payloads, the Cross-Site Scripting was found exploitable via a special payload.

Proof of Concept

1. Go to  https://localhost/scanEngine/hackerone_settings
2. Scroll down to the Markdown editor and feed the payload [clickme](javascript:this;alert(document.cookie)) and save or click on eye icon.
3. Cick on the hyperlink "clickme"
4. XSS popup with CSRF token will appear.

Impact

Although the sessionid cookie is not readable due to samesite Cookie attribute but an attacker would be able to steal the victim's CSRF token and perform further CSRF attacks, localStorage data, etc.