Description

Reflected XSS in /demo/module/?module= bypass of fix for CVE-2022-1439

Proof of Concept

In this report I showed an XSS and while one of the filter evasion mechanisms was fixed, the root cause persists to allow other payloads.

As I mentioned there are event handlers which are unblocked, so even without the <x> trick from last report, you can get XSS.
Here I use ontransitionrun, there are more and there will always come more event handlers, so a blacklist approach will fail here.

https://demo.microweber.org/demo/module/?module=%27ontransitionrun=alert(1)%27%22tabindex=1&style=transition:outline%200.001s&id=x&data-show-ui=admin&class=x&from_url=https://demo.microweber.org

Hitting “tab” will fire the payload.

How to fix this

The html looks like this:

<div>