XSS in installation script

[Seongil Wi]

Hi,

Our research team in KAIST WSP Lab found a reflected vulnerability in chevereto-free (https://github.com/Chevereto/Chevereto-Free).
I post this thread to report the found bug

- Description: An reflected XSS vulnerability was identified in the ready.php page in the installation process due to insufficient sanitization of the $_POST['username'] variable. As a result, arbitrary Javascript code can get executed.

▶ Reproduction steps

1. Install the Chevereto until the ready status (after connection with DB. Note that when we install the app with Docker compose, we can go to the ready state directly)
2. Access to the http://[localhost]/install using post request with username parameter. The value of the parameter should be hihi"><script>alert(1)</script>

😢 Unexpected result

Reflected Cross-Site Scripting (XSS) may allow an attacker to execute JavaScript code in the context of the victim’s browser. This may lead to unauthorized actions being performed, unauthorized access to data, stealing of session information, denial of service, etc. An attacker needs to coerce a user into visiting a link with the XSS payload to be properly exploited against a victim.


📃 Error log message

 

[Rodolfo]

Thanks for reporting.

This may lead to unauthorized actions being performed, unauthorized access to data, stealing of session information, denial of service, etc.

I will take care of it.

 

[Seongil Wi]

I believe that attackers will be able to do several malicious acts including but not limited to phishing, temporary deface, DoS, browser key-logger and others.

 

[Rodolfo]

No, it won't cause that. The username parameter is only used when installing the software from scratch. Once the software gets installed the username field for /install is not handled at all.

 

[Rodolfo]

No longer an issue, also I took care of updating the design in that view.