Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore

Valid

Reported on

Jan 11th 2022

Description

The application does not escape special characters before output to FE, lead to stored XSS.

Proof of Concept

  1. Go to Workflows > Create Workflow > Add Task/Event

  2. Set a title with XSS payload, e.g: aa<svg/onload=alert('hacked')>

Impact

XSS can have huge implications for a web application and its users. User accounts can be hijacked, change the html screen and insult the organization. Credentials could be stolen, sensitive data could be exfiltrated, and lastly, access to your client computers can be obtained.

We are processing your report and will contact the orchardcms/orchardcore team within 24 hours. a year ago
We have contacted a member of the orchardcms/orchardcore team and are waiting to hear back a year ago
We have sent a follow up to the orchardcms/orchardcore team. We will try again in 7 days. a year ago
A orchardcms/orchardcore maintainer validated this vulnerability a year ago
laladee has been awarded the disclosure bounty
The fix bounty is now up for grabs
A orchardcms/orchardcore maintainer marked this as fixed in 1.2.2 with commit 218f25 a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation