Lucene search

Choocs2E12B773-B6A2-48DA-A4BB-55D5D1307D2E

HistoryMar 13, 2023 - 1:52 a.m.

Cross Site Scripting (XSS) in Assets

2023-03-1301:52:23

choocs

www.huntr.dev

cross-site scripting

injection

malicious scripts

web application

flaws

browser side script

input validation

asset upload

proof of concept

admin login

end user

EPSS

0.001

Percentile

24.0%

JSON

Description

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

Proof of Concept

Step 1: Create a file named evil.html

&lt;html&gt;
&lt;script type="text/javascript"&gt;alert(document.domain)&lt;/script&gt;
&lt;/html&gt;

Paste the code above inside the file of evil.html

Step 2: Login as admin

Step 3: Go to Assets

Step 4: Upload the created file

Step 5: Copy asset link and paste it at a new tab.

Step 6: XSS triggered

References

owasp.org/www-community/attacks/xss/

EPSS

0.001

Percentile

24.0%

JSON

Related for 2E12B773-B6A2-48DA-A4BB-55D5D1307D2E