Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore
Reported on
Jan 12th 2022
Description
The Stored XSS vulnerability occurs because the menu editing function can insert a JavaScript Scheme as the value of the menu's HREF.
Proof of Concept
1. Go to Content -> Menu -> Edit
2. Enter javascript:alert(document.domain) as the URL value using the Add or Edit menu function.
3. After saving, use the Preview function to access and click the menu in the Bar.
Video : https://youtu.be/tAzuDCUhSZ4
Impact
Through this vulnerability, an attacker is capable to execute malicious scripts.
Occurrences
AdminMenu.cs L3
I am sorry because I cannot found ,, code,,
I will evaluate the validity of the issue with other maintainers. This is not straightforward since the feature is supposed to let you be able to write custom HTML links on the front-end (this is a CMS). Outcomes could be to protect this feature behind a specific permission.
..? The vectors I found do not use HTML Injection. This occurs because the javascript scheme is allowed when creating a simple link. In my experience, there seems to be no javascript scheme validation in this service.
I understand, and many web developers need to create menus that include javascript. This might explain why this input was not "sanitized". This is why I need to talk to other maintainers, to ensure it was not intentional.