Silverstripe CMS 5.2 : Malicious File Upload (XSS in PDF)

Description:

# An Issue is discovered in Silverstripe CMS 5.2

# We have identified a vulnerability that allows an authenticated account with “Edit any file” permissions to upload a PDF file containing malicious javascript code (Stored Cross-Site Scripting) into the target system. If the PDF file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted javascript to the target .

Affected Component:

http://[ip]/admin/assets/api/createFile

http://[ip]/admin/graphql

Payload:

%PDF-1.7
        1 0 obj
        <</Pages 1 0 R /OpenAction 2 0 R>>
        2 0 obj
        <</S /JavaScript /JS (app.alert('Grim The Ripper Team'))
        >> trailer <</Root 1 0 R>>

Proof of Concept:

First, log in to the target application using an admin account or any other user account that has the “Edit any file” permission.

http://[ip]/Security/login?BackURL=%2Fadmin%2Fpages

Next, choose “Add new”.

New page function.

Then create new page by follow this step.

1. Select “Under another page”.
2. Select “Contact Us” page.
3. Select “Page Generic content page”.
4. Click “Create” for add new page.

Add new page console.

Then follow this step.

1. Define new name page (This step is optional).
2. Select picture icon (Select from Files).

Manage content in the new page.

Then select “Upload” and choose malicious pdf file that needs to upload.

Upload file to the target.

Will find that the file can be uploaded successfully.

Upload file successfully.

Then insert file to the web page by follow this step.

1. Select pdf file (xss by grim).
2. Define link text & link description (exp : ClickMe!!).
3. Check-up “Open in new window/tab”.
4. Click “Insert file”.

Step to insert file to the web page.

Then click “Publish” for publish new page to the site.

New page console.

Will find that the new page can be published successfully.

New page published successfully.

Finally, trigger malicious pdf file by follow this step.

1. Select “Contact Us” page.
2. Select “XSS TEST” page.
3. Check “ClickMe!!” for open pdf file.

Trigger malicious pdf file on the target.

The XSS payload will run immediately.

Payload was execute on the target.

Author:

Grim The Ripper Team by SOSECURE Thailand.