CVE-2023-40816-HTML injection-Activity Milestone
- Vendor of the product(s) –
- Product Name – OpenCRX
- Version – exact ver of the product which is vulnerable – 5.2.0
- Affected component(s) – Activity Milestone
- Attack vector(s) – Web Application
- Suggested description of the vulnerability for use in the CVE- HTML injection on the Activity Milestone
- Discoverer(s)/Credits – your name -Nandini Sharma
- Step by Step POC written in sequential order – prepare a word file for all this.
Title: HTML injection at Category Creation
INTRODUCTION
HTML Injection is a type of web application security vulnerability where an attacker is able to inject malicious HTML code into a web page viewed by other users. The attack can be launched by an attacker who enters specially crafted HTML code, such as script tags or iframe elements, into the input field. The web application may then display this malicious HTML code to other users, potentially executing the code in their web browser and allowing the attacker to carry out their malicious actions.
eSecForte Technologies Security Researcher – Nandini Sharma reported a HTML Injection
Description: HTML Injection in which attacker simple insert payload at Activity Milestone on the name filed and it executed when attacker save the Activity Milestone.
Platform/Product: OpenCRX
Vulnerability Name: Html Injection
Affected Component: Activity Milestone Name Field
Attack Type:
Impact:
HTML injection can result in the modification of web page content or the execution of malicious scripts, leading to the theft of sensitive information, malware distribution, phishing attacks, defacement of websites, or denial of service. It can have a significant impact on the reputation and security of a website and the organization that runs it.
Recommendation:
Preventing HTML injection requires proper input validation and sanitization of user input.
Method of Exploitation
Step to reproduce: –
Step-1 Navigate to https://demo.opencrx.org/opencrx-core-CRX/ObjectInspectorServlet?requestId=3D06QMASG8CMLDTV63YISTS8F&event=24?loginFailed=false and login as Guest credentials
Step-2 Now, create new Milestone in the Manage activity as shown below: –
Step-3 Now, Insert Html payload in the Name field as shown below:-
Paylaod – <font color=”red”>Hacked by eSecforte</font>
Note: HTML execute on Following Section
Name in General Section
Description in General Section
Categories in System Section
External Link in System Section
Reason in System Section
Step-4 Now, click on the save button to save this activity Categor
Now, click on the save button to save this activity Milestone. It has been observed by the auditor that HTML payload execute successfully.
Note: HTML execute on Following Section
Name in General Section
Description in General Section
Categories in System Section
External Link in System Section
Reason in System Section
[Discoverer]
Nandini Sharma from eSec Forte Technologies Pvt. Ltd