Cockpit CMS 2.7.0 File Upload - XSS

Author: (Sergio)

Description: File upload vulnerability in Cockpit CMS 2.7.0 allows a local attacker to upload a pdf file with hidden XSS.

Attack Vectors: AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

---

POC:

This is the software version.

This is the content of the XSS injected in the PDF file.

When logging into the panel, we will go to the "Assets." section off General Menu and click on Upload Asset.

We upload the injected PDF file:

In the following evidence we can see that it has been uploaded correctly:

To access the Injected PDF we click on the file as shown below:

And we copy the link of the server path and the ID of the file where it is stored:

We access the copied URL and the XSS pop-up appears

Next, I have developed another PoC where I explain how I created the malicious PDF file and took advantage of the vulnerability to obtain the XSS:

The first thing is to generate the malicious PDF with hidden XSS.

To do this, we create a .js file with the Javascript code that we want to inject for the XSS in the PDF file.

Then we create an empty PDF file (pdf2go) and inject the payload of the .js file using the JS2PDFInjector tool

We can analyze the content of the injected PDF using the Peepdf tool.

There is an object with javascript code in object[3] and we can check it using pdf-parser tool from Peepdf toolkit.

I have renamed the file to have it more at hand.

We upload the file in Assets:

And when we open it we have the XSS of the PDF file stored on the server.

Additional Information:

https://getcockpit.com/