FirstBlood-#947 — [COLLAB]Vaccination Management portal is vulnerable to Stored XSS
This issue was discovered on FirstBlood v2

On 2021-10-27, mrrootsec Level 2 reported:

Dear FirstBlood security team, we found a vulnerability on your service. we hope this report will help you.

This bug is found with my collaboration partner mrroot, huge thanks to him

Summary

Vaccination Management portal page shows User-Agent value recorded in Vaccination Proof file was uploaded. However, this functionality is vulnerable to Stored XSS.

Vulnerability Description(PoC)

First of all, Vaccination Management portal page shows User-Agent value recorded in Vaccination Proof file was uploaded like below:

If we modify User-Agent header value when uploading, then it reflects as we expected. (Look at User-Agent header value in right side)

Next, if we input XSS payload in User-Agent header, then it causes XSS.

vaccination_manager Cookie has HttpOnly flag so not vulnerable to XSS, but drps session is still vulnerable so this XSS still has a huge impact.

Impact

  • the attacker can steal drps session Cookie(in this case, admin account's drps session)
  • Phishing

Regards, kinako and mrroot

P2 High

Endpoint: /vaccination-manager/portal.php

Parameter: User-Agent header

Payload: User-Agent: <script>alert(document.cookie)</script>

FirstBlood ID: 29
Vulnerability Type: Stored XSS

When uploading a vaccine proof it is possible to achieve stored XSS against admins set via the user agent. As this value typically can't be user controlled the developers did not think it was 'worth' preventing against XSS.