PeTeReport 0.5 - Stored XSS (Markdown)
4,8
Medium
Discovered by
Offensive Team, Fluid Attacks
Summary
Full name
PeTeReport 0.5 - Stored XSS (Markdown)
Code name
State
Public
Release date
Affected product
PeTeReport
Affected version(s)
0.5
Fixed version(s)
0.6
Vulnerability name
Stored cross-site scripting (XSS)
Vulnerability type
Remotely exploitable
Yes
CVSS v3.1 vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v3.1 base score
4.8
Exploit available
No
CVE ID(s)
Description
PeteReport Version 0.5 allows an authenticated admin user to inject persistent javascript code inside the markdown descriptions while creating a product, report or finding.
Proof of Concept
Steps to reproduce
Click on 'Add Product'.
Insert the following PoC inside the product description.
Click on 'Save Product'.
If a user visits the product and click on the link in the description the javascript code will be rendered.
Our security policy
We have reserved the ID CVE-2022-25220 to refer to this issue from now on.
System Information
Version: PeteReport Version 0.5.
Operating System: Docker.
Web Server: nginx.
References
GitHub repository: https://github.com/1modm/petereport
Patch: https://github.com/1modm/petereport/commit/7f3b0a20d4a06da599e386dbad3189f78586c949
Exploit
There is no exploit for the vulnerability but can be manually exploited.
Mitigation
An updated version of PeteReport is available at the vendor page.
Credits
The vulnerability was discovered by Oscar Uribe from Fluid Attacks' Offensive Team.
Timeline
Vulnerability discovered
Vendor contacted
Vendor replied
Vendor confirmed
Vulnerability patched
Public disclosure
Does your application use this vulnerable software?
During our free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.
