Cross-site Scripting (XSS) - Stored in snipe/snipe-it


Reported on

Dec 12th 2021


Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

Proof of Concept

1. Go to Settings > Asset models.

2. Edit/add an item and set name field with xss payload, e.g: Macbook Pro 13" <h><img/src/onerror=alert('laladee')>

3. Go to Assets > select All Ready to Deploy > check out an item in "Checkout to" field, select Asset, choose Asset contain xss payload which named above.

4. Submit check out and go to All deploy/list all, XSS will be execute


XSS can have huge implications for a web application and its users. User accounts can be hijacked, change the html screen and insult the organization. Credentials could be stolen, sensitive data could be exfiltrated, and lastly, access to your client computers can be obtained.

We are processing your report and will contact the snipe/snipe-it team within 24 hours. 2 years ago
We have contacted a member of the snipe/snipe-it team and are waiting to hear back 2 years ago
snipe validated this vulnerability 2 years ago
laladee has been awarded the disclosure bounty
The fix bounty is now up for grabs
snipe marked this as fixed in 5.3.5 with commit 9d5d1a 2 years ago
snipe has been awarded the fix bounty
This vulnerability will not receive a CVE
to join this conversation