Root Cause

The application fails to properly sanitize user input in the Bio field before storing it in the database and rendering it on the profile page. The HTML is rendered directly without escaping special characters or removing potentially dangerous tags and event handlers.

Attack Vector

• Attack Type: Stored XSS
• Input Vector: User Profile Bio field
• Execution Context: Any user viewing the attacker's profile
• Authentication Required: Yes (attacker needs a valid account)

Proof of Concept

Prerequisites

• Running instance of FreelanceHub application
• Web browser (Chrome, Firefox, Edge, etc.)
• Access to create a user account

Step-by-Step Reproduction

Step 1: Create a New Account

1. Navigate to http://localhost:8080/auth
2. Sign up for a new user account using valid credentials
3. Complete the registration process and log in

Step 2: Navigate to Profile Page

1. After successful login, navigate to http://localhost:8080/profile
2. Locate the Bio field in the profile edit form

Step 3: Inject XSS Payload

1. In the Bio field, enter the following payload:
   root@kitploit:~

Step 4: Submit the Form

1. Click the Save or Update Profile button
2. Wait for the confirmation that the profile has been updated

Step 5: Trigger the XSS

1. Visit or reload the profile page: http://localhost:8080/profile
2. The JavaScript alert box will execute automatically
3. Result: The JavaScript code executes successfully, confirming the stored XSS vulnerability

Expected Behavior

The application should sanitize the input and either:

• Strip all HTML tags from the Bio field
• Encode special characters (<, >, ", ', etc.)
• Implement Content Security Policy (CSP) headers

Actual Behavior

The malicious HTML/JavaScript payload is stored in the database and executed when the profile page is rendered, without any sanitization or encoding.

Impact Assessment

Severity: HIGH

CVSS v3.1 Score: 8.1 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Real-World Impact

1. Session Hijacking: Attackers can steal session tokens and impersonate users
2. Credential Theft: Malicious scripts can create fake login forms to capture credentials
3. Data Exfiltration: Sensitive user data can be sent to attacker-controlled servers
4. Malware Distribution: Users can be redirected to malicious websites
5. Phishing Attacks: The trusted domain can be used to host convincing phishing content
6. Account Takeover: Combined with other vulnerabilities, this can lead to full account compromise