Cross-site Scripting (XSS) - Stored in leantime/leantime


Reported on

Aug 17th 2021

✍️ Description

Stored xss bug using a xss payload in the todo name when adding a todo item

🕵️‍♂️ Proof of Concept

Goto http://localhost/tickets/showKanban and add a todo item and copy paste the following xss payload in the todo-name

"><img src=x onerror=alert(document.cookie)>

alt text Click on safe and go to the My Timesheets tab and see the xxs pop up alt text

💥 Impact

Possible to steal admin cookies or take over another account via cookie grepping.

💥 Remediation

Validate user input


We have contacted a member of the leantime team and are waiting to hear back a year ago
Marcel Folaron validated this vulnerability a year ago
ribersec has been awarded the disclosure bounty
The fix bounty is now up for grabs
Marcel Folaron confirmed that a fix has been merged on 7cbdbf a year ago
Marcel Folaron has been awarded the fix bounty
to join this conversation