FirstBlood-#786 — Stored XSS Leads to Admin Account Takeover
This issue was discovered on FirstBlood v2

On 2021-10-28, mrrootsec Level 2 reported:

Hello Zseano,Hope you are doing well

Description :

When cancelling the appointment the message field is accepting the client side input without encoding properly and it will lead to Cross site scripting attack

Steps to Reproduce the issue:

  1. Navigate to https://bceba5ac7db6-mrrootsec.a.firstbloodhackers.com/book-appointment.php

  2. Provide neccesary values int he appointment form and Book Appointment

  3. Copy the Appointment ID and go to https://bceba5ac7db6-mrrootsec.a.firstbloodhackers.com/yourappointments.php, provide the copied ID and click on manage appointment

  4. Now click on Cancel Appointment and Capture this request into Burp-suite and send it to the Repeater TAB

  5. If we observe at drpanel will see the message at cancelled appointments.What if we add our custom message when processing the request like below

  6. If we login with drAdmin credentials and go to https://bceba5ac7db6-mrrootsec.a.firstbloodhackers.com/drpanel/cancelled.php

  7. Xss will fire with cookies

Impact :

  1. As an attacker i can steal admin cookies and impersonate the admin user.

Remediation / Fix:

  1. Implement Input Validation Input validation is the process of ensuring that a web application returns only trusted and proper data in order to prevent malicious data from entering the system and causing harm to the site, users, and database.
  2. Set the HTTPOnly flag of your session cookie and other custom cookies you may have that are not accessed by any JavaScript code
  3. Another great way of mitigating the impact of an XSS flaw can be implementing a robust content security policy
  4. Use Security Headers Set the X-XSS protection header to “X-XSS-Protection: 0” to disable the XSS Auditor, preventing it from taking the default browser to handle responses.

References :

  1. https://rules.sonarsource.com/php/RSPEC-5131

Thanks and Regards MOHAMMAD SAQLAIN

P2 High

Endpoint: /manage-appointment.php

Parameter: msg

Payload: NA

FirstBlood ID: 22
Vulnerability Type: Stored XSS

Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.