(XSS) Cross-Site Scripting Vulnerability - /view_resources/

[iamaldi]

Summary

The Note parameter of a resource is vulnerable to cross-site scripting.
The user input data is not properly sanitized in the resource creation process as well as when the resource is viewed via a shared link.

Vulnerability Details

Severity: High
OWASP Category: A3 – Cross-Site Scripting (XSS)
OWASP Page: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

Proof of Concept URL

1. Navigate to this URL https://threerstore.herokuapp.com/view_resources/WzgsInNlY3JldCJd.DuaiXw.zg0dyJwNWEs63kYgpvW0OW0mUfs
2. Notice the pop-up alert box indicating that the XSS payload was executed successfully

Remediation

User input should be validated and escaped properly during the resource creation process as well as during its reflection back to the user under the /view_resources view.

The following chunk of code is where user input should be escaped and sanitized properly before it's shown back to the user.

3RStore/_3RStore/templates/resources_public.html

Lines 67 to 79 in 49ccb10

	<!-- Note section -->
	{% if re.note %}
	<div class="card-footer">
	{% if re.note.split('</br>') | length > 5 %} <!-- If note has more than 5 lines -->
	<button class="btn btn-info" type="button" data-toggle="collapse" data-target="#{{re.re_id}}_note">Expand/Collapse Note</button>
	<p id="{{re.re_id}}_note" class="collapse re_note"><br>{{ re.note | safe }}</p>
	{% else %}
	<p id="{{re.re_id}}_note" class="re_note">
	{{ re.note | safe }}
	</p>
	{% endif %}
	</div>
	{% endif %}

And, the following code is where user input data should be escaped before it is inserted into the database to prevent arbitrary code injection.

3RStore/_3RStore/views.py

Lines 307 to 313 in 49ccb10

	if request.method == 'POST' and form.validate():
	title = form.title.data
	link = urllib.parse.unquote(form.link.data)
	note = form.note.data.replace('\n','</br>') # So we can show the newlines in the note section
	timestamp = datetime.datetime.fromtimestamp(
	time()).strftime('%Y-%m-%d %H:%M:%S')

Note

Currently the app has crashed due to another critical bug. Once it's up and running again I will update this issue to include more detailed steps on how to exactly reproduce the issue.