Summary #
Stored XSS affects all users (admin/normal) via globally accessible tags. In the Director / Configure director / JobDefs, add a global tag and intercept the request. Add the XSS payload in value of the tag name. Once assigned the payload gets executed. The payload gets executed for every user defined within the application allowed to see jobs / initiates generic XSS payload execution within the application.
General information #
Description: The tag name within Director / Configure director / JobDefs is vulnerable to Stored Cross-Site Scripting (XSS).
Versions Affected: 1.0.0 through 6.5.0
Version Fixed: 6.5.1
Researcher: HEKK.ONE
Creating a new normal user #
To showcase that a normal user can be affected by this vulnerability, we first create a Normal user.
On a fresh install of Bacularis 6.5.0.
docker run -d -p 9097:9097 bacularis/bacularis-standalone:6.5.0-alpine
Login with admin:admin, go to Security / Users / Add user.
We give the new user these values for name and password: test:password1, and select Normal user. Now click Save.
Proof-of-Concept (POC) Exploit #
Go to Director / Configure director / JobDefs. Click on the tag icon in the Tag column, for the job DefaultJob.
Now add a tagname, ex. test and click on Create a new tag.
Once clicked the window will expand, select a color, set the accessibility to Global tag. This will make the exploit work on any user, using this application. Now set a listener on (using ex. BURO.CAIDO) to intercept requests and select Create to create the tag.
Once intercepted, we see the following. The msg_envelope_search=&PRADO_CALLBACK_PARAMETER parameter, contains URL encoded JSON with this ex. URL decoded value: {"tag":"test","color":"blue","color_vals":{"name":"blue","bg":"#2196f3","fg":"white"},"severity":"3","access":"global"}.
Encoded it looks like this: %7B%22tag%22%3A%22test%22%2C%22color%22%3A%22blue%22%2C%22color_vals%22%3A%7B%22name%22%3A%22blue%22%2C%22bg%22%3A%22%232196f3%22%2C%22fg%22%3A%22white%22%7D%2C%22severity%22%3A%223%22%2C%22access%22%3A%22global%22%7D
And in BURP it looks like this:
Now change the value of the tag name from test to: <script>prompt()</script>. The payload should look like this:
## URL encoded payload
%7B%22tag%22%3A%22<script>prompt()</script>%22%2C%22color%22%3A%22blue%22%2C%22color_vals%22%3A%7B%22name%22%3A%22blue%22%2C%22bg%22%3A%22%232196f3%22%2C%22fg%22%3A%22white%22%7D%2C%22severity%22%3A%223%22%2C%22access%22%3A%22global%22%7D
Now forward the request and the payload gets executed.
However, when we click OK we cannot seem to Assign the tag to the job.
Intercepting this Assign request show the server response is a HTTP/1.1 500 Internal Server Error. So we click on the close button in the top right corner or just press the escape button on your keyboard.
Now, when we click, for ex. on the Jobs menu-item we get this. The payload gets executed all around the application.
Testing the exploit as a normal user #
Now, let’s test it for our created test user and if this also effects this Normal user. First, hit the Logout in the top left corner. Login as the new user with these credentials: test:password1. We get logged in as a normal user. Click for example Jobs to get the payload executed.
