Summary #
A stored XSS impacting every user defined within the application allowed to see clients details. Add a client and enter the XSS payload in the address field. Once saved, execute the payload by clicking on the Details button.
General information #
Description: The Address field within the defining a new client is vulnerable to Stored Cross-Site Scripting (XSS).
Versions Affected: 1.0.0 through 6.5.0
Version Fixed: 6.5.1
Researcher: HEKK.ONE
Creating a new normal user #
To showcase that a normal user can be affected by this vulnerability, we first create a Normal user.
On a fresh install of Bacularis 6.5.0.
docker run -d -p 9097:9097 bacularis/bacularis-standalone:6.5.0-alpine
Login with admin:admin, go to Security / Users / Add user.
We give the new user these values for name and password: test:password1, and select Normal user. Now click Save.
Proof-of-Concept (POC) Exploit #
Go to Clients / Add client.
Now add our XSS payload (<script>prompt()</script>) by entering data, like shown below: name:desc:<script>prompt()</script>:password1:MyCatalog.
Click Create and the resource is created. Click OK to return to the list of clients.
Our new client name is created. To execute the payload click on the Details icon.
Testing the exploit as a normal user #
Now, let’s test it for our created test user and if this also effects this Normal user. First, hit the Logout in the top left corner. Login as the new user with these credentials: test:password1. We get logged in as a normal user.
Click on Clients to see the newly created client.
Click on the Details button to execute the payload logged in as a normal user.
