ebankIT 6 Cross Site Scripting

`CVE-2023-30454  
  
[Description]  
An issue was discovered in ebankIT before version 7.  
Document Object Model based XSS exists within the  
/Security/Transactions/Transactions.aspx  
endpoint. Users can supply their own JavaScript within the  
ctl100$ctl00MainContent$TransactionMainContent$accControl$hdnAccountsArray  
POST parameter that will be passed to an eval() function and executed  
upon pressing the continue button.  
  
------------------------------------------  
  
[Vulnerability Type]  
Cross Site Scripting (XSS)  
  
------------------------------------------  
  
[Vendor of Product]  
ebankIT  
  
------------------------------------------  
  
[Affected Product Code Base]  
ebankIT - Omnichannel Digital Banking Platform - Version 6, patched in version 7  
  
------------------------------------------  
  
[Affected Component]  
The endpoint existing at: /Security/Transactions/Transactions.aspx  
  
------------------------------------------  
  
[Attack Type]  
Remote  
  
------------------------------------------  
  
[Impact Code execution]  
true  
  
------------------------------------------  
  
[Attack Vectors]  
I discovered a Document Object Model-based Cross-Site Scripting issue  
within the ebankIT platform. While manually inspecting the client-side  
JavaScript code I came across the variable JSONText. This variable  
was using the eval function to parse data passed to it through the  
accobj variable. Knowing the eval function evaluates text as  
JavaScript, I proceeded to locate exactly what data was passed to this  
variable. I found that the data could be supplied by a user during a  
Transfer request (on /Security/Transactions/Transactions.aspx), when  
selecting which account to transfer from. To execute this XSS, I  
intercepted our test user s Transfer request, supplied my own custom  
JavaScript alert(4) in the  
ctl100$ctl00MainContent$TransactionMainContent$accControl$hdnAccountsArray  
POST parameter, and pressed the continue button which resulted in  
the payload successfully executing.  
  
------------------------------------------  
  
[Discoverer]  
Jake Murphy  
`