XSS vulnerabilities via various embeds in outline/outline
Reported on
Jul 5th 2023
Description
JSFiddle, Gliffy, Otter and Tldraw embeds lack sufficient input validation. Every one of them can be abused to achieve a stored XSS on a main application domain.
This XSS triggers for everyone viewing the document.
Proof of Concept
PoC file is different for each vulnerable embed. See PoCs in Occurrences section
Steps to reproduce
- Save PoC content to a file
- Upload this file to Outline via
import document
XSS triggers for everyone viewing this document
Technical details
These vulnerabilities are possible due to a combination of two factors:
- RegExps are missing
^at the beginning. - Components use
props.attrs.hrefassrcfor resultingiframe
For example, a line
javascript:...//https://jsfiddle.net/a/b
would be processed by JSFiddle embed and result in
<iframe src="javascript:...//https://jsfiddle.net/a/b" ... >
which leads to payload being executed in the context of the main domain.
Mitigation recommendations
- Add
^in the beginning of the RegExps - Do not reflect
props.attrs.hrefin the responses
Impact
Anyone with permissions to create new documents is able to run arbitrary javascript code in other users' browsers within application's main domain.
Attacker is able to do everything a victim has rights to do within the app. The most straightforward way to abuse it would be to:
- Steal victim's users session
- Issue a new API token for victim and exfiltrate it
If attacker has Editor role, this XSS could be used against a user with administrative permissions to escalate to the Admin role.
I found three more XSS vulnerabilities in other embeds and would like to report them to you.
Vulnerable embeds are: Gliffy, Otter and Tldraw.
For some weird reason, huntr.dev does not let me create multiple reports with the same type of vulnerability.
It forces me to report other vulnerabilities here as Occurrences.
It does not feel right to me. I feel that these are four separate XSS vulnerabilities in different components. Not for occurences of the same XSS vulnerability.
What is your position on this?
What is your position on this?
These are clearly the same bug in the same component 👍
same bug in the same component
Ok, I'll add them here in the Occurences
Tom, I changed wording of the report a little bit, so that it describes all four embeds at once.
PoCs for each individual embed are in Occurrences.
Also, I updated patch to fix all four embeds.
I'm reserving critical for vulnerabilities that extend outside of the team scope, considering you have to be an editor on the team you're basically attacking your own workspace.
Thank you for the bounty!
Tom Moor modified the Severity from Critical (9.6) to High (8.5)
I agree that these XSS do not feel like critical. It just happened that CVSS calculations lead to it.
Also, what happened to the Occurrences? I've got paid as for one single vulnerability.
I don't know, but this is one vulnerability – it was fixed by adding a missing sanitize call.