Coderberg/ResidenceCMS

A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1

Opened this issue · 4 comments

EDMPL commented

A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious property content with HTML inside it, which acts as a stored XSS payload. If this property page is visited by anyone including the administrator, then the XSS payload will be triggered.

Below is a simple step-by-step on how to reproduce the issue:

  1. Login as a low privilege user (In this case we can use the default low-privilege user).

image

  1. Create or Edit one of the user owned property (In this case we can user the default property owned by the user).

image

  1. Fill the content form with XSS payload using the Code View feature. Before saving it make sure to go back using the usual view to see if the HTML is rendered or not.

image

  1. After saving the new property content and clicking the 'Finish Editing', go to the page and see the XSS is triggered. In this case I use administrator account to trigger the XSS.

image

Coderberg commented

Hi @EDMPL
Thank you for your observation. I created a small fix in branch 2.x

EDMPL commented

Hi,

Thanks for the response and fix. Is it possible to push the fix to the master and make a new release version of the app? I'm afraid that all release right now is vulnerable to the issue above.

Coderberg commented

Yes

EDMPL commented

Hi.

Thanks for the fast response. But I think that the 2.10.2 version is also still vulnerable to the XSS.

image