FirstBlood-#694 — [COLLAB]Vaccination Management portal is vulnerable to Stored XSS
This issue was discovered on FirstBlood v2.0.0 (issues patched)
On 2021-10-27, kinako reported:
Dear FirstBlood security team, we found a vulnerability on your service. we hope this report will help you.
This bug is found with my collaboration partner mrroot, huge thanks to him
Vaccination Management portal page shows User-Agent value recorded in Vaccination Proof file was uploaded. However, this functionality is vulnerable to Stored XSS.
First of all, Vaccination Management portal page shows User-Agent value recorded in Vaccination Proof file was uploaded like below:
If we modify User-Agent header value when uploading, then it reflects as we expected. (Look at User-Agent header value in right side)
Next, if we input XSS payload in User-Agent header, then it causes XSS.
vaccination_managerCookie has HttpOnly flag so not vulnerable to XSS, but drps session is still vulnerable so this XSS still has a huge impact.
- the attacker can steal drps session Cookie(in this case, admin account's drps session)
Regards, kinako and mrroot
FirstBlood ID: 29
Vulnerability Type: Stored XSS
When uploading a vaccine proof it is possible to achieve stored XSS against admins set via the user agent. As this value typically can't be user controlled the developers did not think it was 'worth' preventing against XSS.