XSS vulnerability on latest version

Hi all,

I don't think it's a good idea to post this here. But nobody respond to my mail and Dolibarr Official twitter account advise me to post this here (https://twitter.com/MickaelDorigny/status/684456187870457857) so ...

Here is an advisory about XSS Vulnerability on Dolibarr latest version (v3.8.3).

Vulnerability description :

A Stored XSS is available in the Dolibarr 3.8.3 core code. No module needs to be activated to exploit this XSS vulnerability because an attacker can use the user attributes management to do it.

This XSS can be exploited through a basic user account on the dolibarr installation. Impacted users are administrators and users that have right to check other user's attributes.

PoC n°1 : Stored XSS in user attributes:

Once a simple user is connected with his account, he can modifiy his attributes like Last name, First name, Mobile number, etc.. These informations can be reviewed by other users who have administration privileges.

Using the HTML tag and the "onmouseover" JavaScript event, we can force an admin to pass his mouse over the injected image. This event can be used to execute valid JavaScript instructions in the administrator browser or in browser of other users allowed to check user's attributes.

PoC :
As an authenticated user, fullfill "Last name", "First name", "email", "job" or "signature" input with this :
user1< img src=x onmouseover=alert(1) >

This is a PoC Video made by myself to expose the most dangerous usage of this vulnerability : https://www.youtube.com/watch?v=p2rFWJOCJC8

Feel free to ask more details if needed.

[fgeek]

When do you plan to release new version with these patches?

Hi,
I've seen your fix for this specific vulnerability. I have to alarm you that this fix is no sufficient. JavaScript is a very Powerful language and a good security fix will be to avoid JavaScript execution possibility, and not to avoid a specific payload.

If an attacker could not exploit this specific payload, He will exploit another one because JavaScript injection is still allowed (using other HTML tags, other JavaScript events).

I suggest you to read this very good paper about XSS protection :
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

For example, with your fix applied, JavaScript event "onmouseover" will not work, but "onmousemove", which is a similar one, will still work, so the vulnerability is still present.

[hregis]

@eldy @rdoursenaud
same problem with onmousemove, onmouseout, etc....