Description

Stored XSS, also known as persistent XSS, is the more damaging of the XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Due to a sanitization problem it is possible to perform a Stored XSS. The problem is that the upload function permit malicious extensions like svg file. Due to this stored xss it is possible to become admin and perform other malicious actions using api endpoint.

The attack is easily executable by initially bypassing the regex that prevents script uploads, and finally the Content Security Policy.

Step to Reproduce:

1 - The Content Security Policy is script-src 'self' , so the first step will be to upload a "test.js" file via file upload, for example a simple alert(). 2 - Some security and regex checks are implemented to prevent material containing "scripts" from being uploaded. To bypass the regex checks, it is possible, for example, to upload an HTML file and use the tag <ScRipt, with some letters in uppercase. Any inline script will be blocked, but having previously created a "test.js" file containing some code, we can call that and it will run. A possible payload can be:

<Script src='/uploads/tenant/public/attachments/testplans_testplan/7002/test.js'></Script>

Now when an admin or other users will open the link, the XSS will be triggered.

POC Video:

https://drive.google.com/file/d/1eSD2jnbAg6Ef_pJX3uM4J44ro82RLtaS/view?usp=share_link

Impact

Stored XSS to run malicious javascript. Possibility to become admin and use also other api endpoint without permission.