We - The Zalo Security Lab team - have identified a potential security vulnerability in SRS.
If you are NOT the correct point of contact for this report, please let us know at [email protected]!
Summary
SRS's /api/v1/vhosts/vid-<id>?callback=<payload> endpoint didn't filter the callback function name which led to injecting malicious javascript payloads and executing XSS ( Cross-Site Scripting).
Details
When accessing http://localhost:1985/console/en_index.html?x#/vhosts/vid-<id> the website will automatically call the callback API endpoint and create a script for it.
However, the callback function is modifiable which leads to injecting malicious javascript payloads into the callback. Therefore, the attacker can modify the URL into
http://localhost:1985/console/en_index.html?x#/vhosts/vid-xsedfv%3Fcallback=confirm(document.domain)%252f%252f the XSS will be execute.
PoC
Impact
This issue may lead to Cross-Site Scripting.
If the server uses the older version than v5.0.157, v5.0-b1, v6.0.48 this flaw can be used for the earlier Command Injection vulnerability.
antqt Reporter
We - The Zalo Security Lab team - have identified a potential security vulnerability in SRS.
If you are NOT the correct point of contact for this report, please let us know at
[email protected]!Summary
SRS's
/api/v1/vhosts/vid-<id>?callback=<payload>endpoint didn't filter the callback function name which led to injecting malicious javascript payloads and executing XSS ( Cross-Site Scripting).Details
When accessing
http://localhost:1985/console/en_index.html?x#/vhosts/vid-<id>the website will automatically call the callback API endpoint and create a script for it.However, the callback function is modifiable which leads to injecting malicious javascript payloads into the callback. Therefore, the attacker can modify the URL into
http://localhost:1985/console/en_index.html?x#/vhosts/vid-xsedfv%3Fcallback=confirm(document.domain)%252f%252fthe XSS will be execute.PoC
Impact
This issue may lead to Cross-Site Scripting.
If the server uses the older version than v5.0.157, v5.0-b1, v6.0.48 this flaw can be used for the earlier Command Injection vulnerability.