FirstBlood-#787 — Stored XSS on Vaccination Manager Portal through User Agent
This issue was discovered on FirstBlood v2
On 2021-10-28, xnl-h4ck3r Level 4 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Summary
A Stored XSS vulnerability exists on /vaccination-manager/portal.php where a payload can be sent in the User-Agent header of the request.
Steps to reproduce
-
Proxy all requests throguh Burp
-
Go to vaccination-manager/pub/upload-vaccination-proof.php and enter any email address and any image and press UPLOAD
-
Go to Burp history and select the latest POST request to /vaccination-manager/pub/submit-vaccination-proof.php and send to Repeater.
-
In Burp repeater, change the User-Agent header to <svg/onload=alert(document.cookie)> and send:
-
Go to /vaccination-manager/login.php and login to the portal (or use SQLi as mentioned in Report #785) and observe the Stored XSS payload entered in Step 4 executes:
Impact
The impact of this vulnerability is that an attacker could steal the admins drps cookie, potentially allowing them to perform actions as that user that requrie admin authorisation.
P2 High
Endpoint: /vaccination-manager/portal.php
Parameter: User-Agent header
Payload: <svg/onload=alert(document.cookie)>
FirstBlood ID: 29
Vulnerability Type: Stored XSS
When uploading a vaccine proof it is possible to achieve stored XSS against admins set via the user agent. As this value typically can't be user controlled the developers did not think it was 'worth' preventing against XSS.