FirstBlood-#691 — XSS on /vaccination-manager/portal.php through User-agent pollution
This issue was discovered on FirstBlood v2

On 2021-10-27, newrouge Level 3 reported:

Hey, i found stored xss on vaccination-manager portal through User-Agent pollution while uploading vaccine proof.

Description:

  • After logging in vaccine-manager portal, we can see that user's User-Agent's are reflected in response.

    <td>Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:93.0) Gecko/20100101 Firefox/93.0</td>

  • We can break out from td tag and execute xss on dashboard.

steps:

  1. GO to /vaccination-manager/pub/upload-vaccination-proof.php .

  2. Upload a file and enter email and then intercept request.

  3. Enter payload in user-agent field.

  4. Now send the request and load the panel, xss should execute.

Impact:

it can be used to steal vaccination-manager cookie easily & login into dashboard.

Thank you

newrouge

P2 High

Endpoint: /vaccination-manager/portal.php

Parameter: N/A

Payload: ;"><script>alert(document.cookie)</script>

FirstBlood ID: 29
Vulnerability Type: Stored XSS

When uploading a vaccine proof it is possible to achieve stored XSS against admins set via the user agent. As this value typically can't be user controlled the developers did not think it was 'worth' preventing against XSS.