Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm
Reported on
Apr 11th 2022
Description
Stored Cross-Site Scripting (XSS) vulnerability due to the lack of content validation and output encoding. This vulnerability can be exploited by uploading a crafted payload inside a document. Then, the vulnerability can be triggered when the user previews the document´s content.
Proof of Concept
https://drive.google.com/file/d/1xJh3wjyBUB5JF0rsbPblrUUREvtHA-EG/view?usp=sharing
Impact
Stored XSS generally occurs when user input is stored on the target server, such as in a database, in a message forum, visitor log, comment field, etc. And then a victim is able to retrieve the stored data from the web application without that data being made safe to render in the browser.
Occurrences
SECURITY.md exists
2 years ago
Hey @aravindd007, thanks for the report. I have two comments and one request, however.
- I think the error category is wrong, because you can't save xss permanently, to the database for example. DOM-Based XSS seems more accurate. Correct me if I'm wrong.
- The file you mentioned has nothing to do with the reported vulnerability.
- Could you verify whether this vulnerability also exists in the dev environment (https://gitdeveloper.yetiforce.com/)?
The input not sanitized properties, yes I can't save permanently is possible to bypass, we can do html injection, iframe injection also.
Yes that is dev environment.
Apologies in advance for continuing this discussion but I'm not sure I understood you. In my opinion there is no way of saving xss permanently in the system regardless of what means of bypassing it were used, since all data are verified additionally on the server side before they're entered to the database for example.
Nevertheless, a few fixes have been uploaded to the dev environment. I'd appreciate if you could check if everything is ok now.
@Maintainer You should reject this vulnerability, It couldn't store the user input and it does not have any impact. The PoC does not show anything. Assign this CVE will make your CRM's reputation is decrease.