[CVE-2022–34961] OSSN 6.3 LTS — Stored XSS Vulnerability at Users Timeline
Vulnerability Explanation:
OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Users Timeline module.
Attack Vectors:
The attacker must post something on the “Users Timeline” and insert the XSS payload at the location input in order to exploit the stored XSS. The XSS payload will be launched immediately after submission.
Affected Component:
- http://ip_address:port/ossn/u/{username}
- POST /ossn/action/wall/post/u?ossn_ts=1656419317&ossn_token=580bcf1b98fec62baecd2e15b7c4c03173f59226623258b968a316f893e8cbf1
Payload :
<img/	  src=~ onerror=prompt('Grim-The-Ripper-Team-by-SOSECURE-Thailand')><BODY ONLOAD=alert('Grim-The-Ripper-Team-by-SOSECURE-Thailand')><img src=x onerror=confirm('Grim-The-Ripper-Team-by-SOSECURE-Thailand')>
Tested on:
- OSSN v6.3 LTS (https://github.com/opensource-socialnetwork/opensource-socialnetwork/releases/tag/6.3)
- Google Chrome Version 102.0.5005.115 (Official Build) (x86_64)
Steps to attack:
1.Login with username and password. (If you don’t have an account, you can register)
2.Go to “Users Timeline” by clicking on their username in the top left corner.
3.We found an user timeline.
4.Enter data in the data entry form. Click on the location button and enter the XSS payload. Then press the Post button.
5.The XSS payload will run immediately.
Discoverer:
Grim The Ripper Team by SOSECURE Thailand
Disclosure Timeline:
- 2022–06–28: Vulnerability discovered.
- 2022–06–28: Vulnerability reported to the MITRE corporation.
- 2022–07–08: CVE has been reserved.
- 2022–07–08: Public disclosure of the vulnerability.
