[FIX] Stored-XSS application-wide

[alromh87]

Metadata *

Bounty URL: https://www.huntr.dev/bounties/2-other-monica

⚙️ Description *

XSS queries being triggered from people info page by the audit log at the settings, fix sanitizes content before showing to user.

Technical Description *

Even tough Laravel has inbuilt protection for XSS it has been disabled when presenting log: {!! $log['description'] !!} to enable embeding contact links, leading to XSS, htmlentities was used to sanitize data before showing to user, efectively avoiding new as well as already stored XSS.

Edit

Looking further into the code I realized the XSS protection have been disabled in many views so I added a Middleware that will strip html tags using strip_tags, and since strip_tags can be tricked with malformed markup reamaning input is encoded using htmlentities.

Middleware is at app/Http/Middleware/SanitizeInput.php and can be tunned for specific keys adding them to the $except array:

    /**
     * The names of the attributes that should not be trimmed.
     *
     * @var array
     */
    protected $except = [
        'password',
        'password_confirmation',
        '_token',
        ''
    ];

Proof of Concept (PoC) *

1. Download and setup monica
2. Create new contact, introducing payload as name:
   < <svg/onload=alert("firstname1")><script> alert("firstname2_xss")</script> <script> alert("midname_xss")</script> <script> alert("Lname_xss")</script><svg/onload=alert(1)> (<svg/onload=alert("nickie1")>)
3. Go to Settings -> Audit logs
4. XSS is triggerd

Proof of Fix (PoF) *

After fix introduced data is displayed as text and no XSS is executed

Stored XSS will be also stripped out and encoded after contact is edited

User Acceptance Testing (UAT)

Functionallity is unafected, contact link works as usual

[huntr-helper]

Congratulations alromh87 - your fix has been selected! 🎉

Thanks for being part of the community & helping secure the world's open source code.
If you have any questions, please respond in the comments section, or hit us up on Discord. Your bounty is on its way - keep hunting!

Come join us on Discord