a32e028b88
17 changes to exploits/shellcodes VxWorks 6.8 - TCP Urgent Pointer = 0 Integer Underflow Linux - Use-After-Free Reads in show_numa_stats() WebKit - UXSS via XSLT and Nested Document Replacements Ghidra (Linux) 9.0.4 - .gar Arbitrary Code Execution ManageEngine OpManager 12.4x - Privilege Escalation / Remote Command Execution (Metasploit) ManageEngine Application Manager 14.2 - Privilege Escalation / Remote Command Execution (Metasploit) ManageEngine OpManager 12.4x - Unauthenticated Remote Command Execution (Metasploit) Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit) BSI Advance Hotel Booking System 2.0 - 'booking_details.php Persistent Cross-Site Scripting Cisco Adaptive Security Appliance - Path Traversal (Metasploit) UNA 10.0.0 RC1 - 'polyglot.php' Persistent Cross-Site Scripting Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticketreply.php' SQL Injection Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticket.php' Arbitrary File Deletion osTicket 1.12 - Persistent Cross-Site Scripting via File Upload osTicket 1.12 - Formula Injection osTicket 1.12 - Persistent Cross-Site Scripting Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'cities.php' SQL Injection Linux/x64 - Bind (4444/TCP) Shell (/bin/sh) + Password (hack) + Null-Free Shellcode (162 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (hack) + Null-Free Shellcode (151 bytes) Linux/x64 - Egghunter (0x50905090) Shellcode (18 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (hack) + Null-Free Shellcode (151 bytes) Linux/x64 - Egghunter (0x50905090) Shellcode (18 bytes) Linux/x64 - execve() + XOR/NOT/DIV Encoded Shellcode (54 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (hack) + Polymorphic Shellcode (122 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell + Password (hack) + Polymorphic Shellcode (135 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (hack) + Polymorphic Shellcode (122 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell + Password (hack) + Polymorphic Shellcode (135 bytes) Linux/x64 - execve() Stack + Polymorphic Shellcode (47 bytes)
55 lines
No EOL
2.1 KiB
Text
55 lines
No EOL
2.1 KiB
Text
# Exploit Title: osTicket-v1.12 Stored XSS via File Upload
|
|
# Vendor Homepage: https://osticket.com/
|
|
# Software Link: https://osticket.com/download/
|
|
# Exploit Author: Aishwarya Iyer
|
|
# Contact: https://twitter.com/aish_9524
|
|
# Website: https://about.me/aish_iyer
|
|
# Category: webapps
|
|
# CVE: CVE-2019-14748
|
|
|
|
1. Description
|
|
|
|
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
|
|
The Ticket creation form allows users to upload files along with queries.
|
|
It was found that the file-upload functionality has fewer (or no)
|
|
mitigations implemented for file content checks; also, the output is not
|
|
handled properly, causing persistent XSS that leads to cookie stealing or
|
|
malicious actions. For
|
|
example, a non-agent user can upload a .html file, and Content-Disposition
|
|
will be set to inline instead of an attachment.
|
|
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14748
|
|
|
|
2. Proof of Concept
|
|
|
|
Steps to Reproduce:
|
|
- Login to the portal as a non agent user:
|
|
- Open a New Ticket
|
|
- Select any option from the dropdown menu present under "Help Topic"
|
|
- Text box appears, enter details accordingly
|
|
- In the section "drop files here or choose them", we would be putting our
|
|
payload
|
|
- Open any text editor and name the file as test(say) with .html extension.
|
|
- Within the file, enter the payload
|
|
<script>alert(document.cookie);</script>
|
|
- Save the test.html file.
|
|
- Now click on drop files here option and enter the test.html file.
|
|
- Click on "create ticket" option
|
|
- Login with another user(agent)
|
|
- Now within the User Directory, go to the user under which the payload has
|
|
been put.
|
|
- The ticket raised with the name mentioned will be shown under the subject
|
|
category.
|
|
- Scroll down and the file uploaded will be present below.
|
|
- Click on the file, and the payload gets executed which is persistent
|
|
|
|
3. Reference
|
|
|
|
https://github.com/osTicket/osTicket/commit/33ed106b1602f559a660a69f931a9d873685d1ba
|
|
https://github.com/osTicket/osTicket/releases/tag/v1.12.1
|
|
https://github.com/osTicket/osTicket/releases/tag/v1.10.7
|
|
|
|
4. Solution
|
|
|
|
The vulnerability has been patched by the vendor in the next release which
|
|
is osTicket v1.10.7. |