FirstBlood-#786 — Stored XSS Leads to Admin Account Takeover
This issue was discovered on FirstBlood v2
On 2021-10-28, mrrootsec Level 2 reported:
Hello Zseano,Hope you are doing well
When cancelling the appointment the message field is accepting the client side input without encoding properly and it will lead to Cross site scripting attack
Steps to Reproduce the issue:
Navigate to https://bceba5ac7db6-mrrootsec.a.firstbloodhackers.com/book-appointment.php
Provide neccesary values int he appointment form and Book Appointment
Copy the Appointment ID and go to https://bceba5ac7db6-mrrootsec.a.firstbloodhackers.com/yourappointments.php, provide the copied ID and click on manage appointment
Now click on Cancel Appointment and Capture this request into Burp-suite and send it to the Repeater TAB
If we observe at drpanel will see the message at cancelled appointments.What if we add our custom message when processing the request like below
If we login with drAdmin credentials and go to https://bceba5ac7db6-mrrootsec.a.firstbloodhackers.com/drpanel/cancelled.php
Xss will fire with cookies
- As an attacker i can steal admin cookies and impersonate the admin user.
Remediation / Fix:
- Implement Input Validation Input validation is the process of ensuring that a web application returns only trusted and proper data in order to prevent malicious data from entering the system and causing harm to the site, users, and database.
- Another great way of mitigating the impact of an XSS flaw can be implementing a robust content security policy
- Use Security Headers Set the X-XSS protection header to “X-XSS-Protection: 0” to disable the XSS Auditor, preventing it from taking the default browser to handle responses.
Thanks and Regards MOHAMMAD SAQLAIN
FirstBlood ID: 22
Vulnerability Type: Stored XSS