Listen to this Post
How the mentioned CVE works:
The vulnerability exists in the CSV import functionality of Snipe-IT. When an admin user uploads an invalid CSV file, the application processes the data via a Livewire component. An attacker can intercept the subsequent POST request to the `/livewire/update` endpoint. By manipulating the `progress_message` parameter within this request and injecting malicious HTML or JavaScript code, the attacker can compromise the system. The server fails to sanitize this input and directly reflects it back into the admin interface. When an authenticated administrator views the import results page, the malicious payload is rendered as raw HTML, causing the arbitrary JavaScript to execute within the context of the admin’s session.
Platform: Snipe-IT
Version: v8.3.4
Vulnerability : Reflected XSS
Severity: Moderate
date: 2024-11-20
Prediction: 2024-12-04
What Undercode Say:
curl -X POST "https://target.com/livewire/update" -d "data[bash][attributes][bash]=<script>alert('XSS')</script>"
<img src=x onerror=stealCookies()>
How Exploit:
Intercept CSV upload request.
Modify `progress_message` parameter.
Inject malicious script payload.
Trick admin into viewing page.
Protection from this CVE:
Sanitize user input.
Escape output properly.
Implement Content Security Policy.
Update to patched version.
Impact:
Admin session hijacking.
Privilege escalation.
Data theft.
Unauthorized actions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
