Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reflected Cross Site Scripting (XSS) in 'roles' | WSO2 API Manager version 2.6.0 | WSO2 Product #21

Open
cybersecurityworks opened this issue Dec 24, 2019 · 0 comments

Comments

@cybersecurityworks
Copy link
Owner

cybersecurityworks commented Dec 24, 2019

Details:

WSO2 Product Bug Report
Bug Name: Reflected Cross Site Scripting (XSS)
Product Name: WSO2
Server: WSO2 API Manager
Version: 2.6.0
Homepage: https://wso2.com/
Severity: Low
Status: Fixed
Exploitation Requires Authentication?: yes

AFFECTED PRODUCTS:

[1] WSO2 API Manager

Description:

Cross Site Scripting (XSS) vulnerability in WSO2 API Manager Product. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged in user’s session by stealing cookies which means that the malicious hacker can change the logged in user’s password and invalidate the session of the victim while the hacker maintains access.

Proof of concept: (POC)

The following Vulnerability is tested on WSO2 API Manager version 2.6.0 Product.

Issue 01: Reflected cross site scripting:

1
Figure 01: Start creating an API

2
Figure 02: Click on Add Scope button to add resources information

3
Figure 03: Enter XSS Payload in Roles section

4
Figure 04: Injected XSS payload, <img src=x onerror=prompt(1)> gets reflected in the same browser as response.


Reproducing Steps

  1. Login to the application (admin/admin) through the login URL.
  2. Go to Design API page to create API.
  3. Fill the details up to manage page.
  4. Choose Add Scope to include resources information
  5. Add XSS payload, <img src=x onerror=prompt(1)> in Roles column
  6. Clicking on Add Scope button executes the injected XSS Payload.

Timeline

2019-07-05 – Discovered in WSO2 API Manager v2.6.0
2019-07-06 – Reported to intigriti platform.
2019-07-08 - Rejected the submission in intigriti platform.
2019-07-24 - Closed the issue by intigriti platform.
2019-07-26 – Discovered in WSO2 API Manager version 2.6.0.
2019-07-26 – Reported to security@wso2.com
2019-07-26 – Got instant response from WSO2 security team, "Thanks for your continuous effort on analyzing security vulnerabilities on WSO2 products. We will evaluate your finding and get back to you as soon as possible with our feedback."
2019-08-05 – Got mail from WSO2 team saying, "We were able to reproduce the issue with APIM 2.6.0. We will fix this and provide you with an update."
2019-08-13 - Fixing in all affected versions
2019-09-10 - Customer Announcement is scheduled
2019-10-08 - Got mail saying, "Customer Security Announcement for the issues are scheduled by the end of September"
2019-11-04 - Customer Announcement is done. Public Announcement is done. Please refer [1] for Security Advisory

Note: Since, we have contributed on WSO2-2017-0265, WSO2-2019-0616, WSO2-2019-0633, WSO2-2019-0634 and WSO2-2019-0635 to WSO2 team, our name already got listed in their security acknowledgment page [2]

[1] https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0644
[2] https://docs.wso2.com/display/Security/Acknowledgments


Discovered by:
Sathish Kumar Balakrishnan from Cyber Security Research Lab

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant