Exploits / Vulnerability Discovered : 2021-03-15 |
Type : webapps |
Platform : multiple
This exploit / vulnerability Openmaint openmaint 2.13.3b multiple persistent crosssite scripting is for educational purposes only and if it is used you will do on your own risk!
Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name And Code Parameters.
Proof of concepts :
1-Login to you'r Dashboard As a low privilege user
2-Click On Facilities and assets - Location - Sites
3- +Add card Building
4- Code and name parameters both are vulnerable
4-Save it
5-Back to Sites and click on previous card
6- in position section click on "Complex" drop down
7- xss will trigger
------------------------------------------------------------------------
Another Xss:
1-Like exmaples above go to Locations and click on Sites
2-Add Card Building or click the one you created before
3-in left menu click on "Relations"
4-click "Add relations" and select one of the options
5- Add Card and select one of the options
6- insert javascript payload to code and name parameter
POST /openmaint/services/rest/v3/classes/Alarm/cards?_dc=1615628392695 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
Connection: close
Cookie: CMDBuild-Localization=en; CMDBuild-Authorization=j130sjfhd7j6fzf88n93ue7l; _ga=GA1.2.786635877.1615617578; _gid=GA1.2.1992324670.1615617578
7- save it and close the form
8-click on the card and there an option which is "Open Relation Graph" click on it and click on card list
9- xss payload will trigger
1-Click Facilities and assets
2-Locations
3-Select one of cards
4-Click "Add Card"
5-in "Attachments" tab click "Add attachment" select "Document" or "image"
6-insert javascript payload in "Code" and "Description"