{"id":24414,"date":"2025-08-28T16:39:12","date_gmt":"2025-08-28T14:39:12","guid":{"rendered":"https:\/\/herolab.usd.de\/usd-2025-19\/"},"modified":"2025-09-10T11:12:48","modified_gmt":"2025-09-10T09:12:48","slug":"usd-2025-0019","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2025-0019\/","title":{"rendered":"usd-2025-0019"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text admin_label=\"Text\" _builder_version=\"4.27.4\" _module_preset=\"default\" custom_padding=\"||13px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n<h1>usd-2025-0019 | d.3one 1.14.16 - Reflective Cross-Site Scripting<\/h1>\n<h1><\/h1>\n<p><strong>Product<\/strong>: d.3one<br \/><strong>Affected Version<\/strong>: 1.14.16<br \/><strong>Vulnerability Type<\/strong>: Cross-Site Scripting (CWE-79)<br \/><strong>Security Risk<\/strong>: High<br \/><strong>Vendor<\/strong>: d-velop<br \/><strong>Vendor URL<\/strong>: <a href=\"https:\/\/www.d-velop.de\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.d-velop.de\/<\/a><br \/><strong>Vendor acknowledged vulnerability<\/strong>: Yes<br \/><strong>Vendor Status<\/strong>: Fixed in version 7.30.13 and 7.33.3<br \/><strong>CVE Number<\/strong>: Requested<br \/><strong>CVE Link<\/strong>: -<br \/><strong>Advisory ID<\/strong>: usd-2025-0019<\/p>\n<h3>Description<\/h3>\n<p><!-- add a description of the application and vulnerability -->By activating a malicious link, it is possible to execute JavaScript in the victim's browser. This can be exploited to call functions in the web interface on behalf of the victim and extract the content of the application. This compromises the confidentiality and integrity of the processed data.<\/p>\n<h3>Proof of Concept<\/h3>\n<p>The following URL opens an alert box with the current domain name as an example:<\/p>\n<div class=\"codehilite\" style=\"background: #263238;color: #eff\">\n<pre style=\"line-height: 125%\"><span style=\"background: #263238\"><\/span>https:\/\/d3one-int.[...].local\/shell\/ng\/#?pentest=1\"&gt;&lt;img]() src=x onerror=alert(document.domain)&gt;<\/pre>\n<\/div>\n<p>Screenshot of the alert box opened via JavaScript:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2025\/08\/xss-proof.png\" width=\"961\" height=\"131\" alt=\"\" class=\"wp-image-24380 size-full\" srcset=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2025\/08\/xss-proof.png 961w, https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2025\/08\/xss-proof-480x209.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 961px, 100vw\" \/><\/p>\n<p>The cause of the vulnerability is the use of the insecure function <strong>Element.insertAdjacentHTML <\/strong>without prior parameter clearing. The following screenshot shows an excerpt of the vulnerable code:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2025\/08\/code-proof.png\" width=\"688\" height=\"262\" alt=\"\" class=\"wp-image-24378 alignnone size-full\" srcset=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2025\/08\/code-proof.png 688w, https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2025\/08\/code-proof-480x183.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 688px, 100vw\" \/><\/p>\n<p>After opening the above URL in the application, you can also see where the payload was embedded, as this has changed the HTML.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2025\/08\/changed-html.png\" width=\"933\" height=\"282\" alt=\"\" class=\"wp-image-24376 alignnone size-full\" srcset=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2025\/08\/changed-html.png 933w, https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2025\/08\/changed-html-480x145.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 933px, 100vw\" \/><\/p>\n<p>The Mozilla documentation on the vulnerable function points out that no user input that has not been cleared should be used: <a href=\"\/\/developer.mozilla.org\/de\/docs\/Web\/API\/Element\/insertAdjacentHTML#sicherheitshinweise&gt;\">&lt;https:\/\/developer.mozilla.org\/de\/docs\/Web\/API\/Element\/insertAdjacentHTML#sicherheitshinweise&gt;<\/a><\/p>\n<h3>Fix<\/h3>\n<p><!-- how the vendor can fix the vulnerability.--><br \/><!-- if you recommended a quick workaround to the customer (and they are fine with you including it here!) feel free to add this information as well -->The use of insecure functions should be prevented.<\/p>\n<h3>References<\/h3>\n<p><!-- add references to the application and vulnerability.--><\/p>\n<ul>\n<li><a href=\"https:\/\/owasp.org\/www-community\/attacks\/xss\/\" target=\"_blank\" rel=\"noopener\">https:\/\/owasp.org\/www-community\/attacks\/xss\/<\/a><\/li>\n<li><a href=\"https:\/\/developer.mozilla.org\/de\/docs\/Web\/API\/Element\/insertAdjacentHTML#sicherheitshinweise\" target=\"_blank\" rel=\"noopener\">https:\/\/developer.mozilla.org\/de\/docs\/Web\/API\/Element\/insertAdjacentHTML#sicherheitshinweise<\/a><\/li>\n<\/ul>\n<h3>Timeline<\/h3>\n<ul>\n<li><strong>2025-04-15<\/strong>: First contact request via mail<\/li>\n<li><strong>2025-04-15<\/strong>: Response from d.velop<\/li>\n<li><strong>2025-04-22<\/strong>: Vulnerability details sent to d.velop<\/li>\n<li><strong>2025-04-22<\/strong>: d.velop confirmed the delivery and begun investigating the matter.<\/li>\n<li><strong>2025-04-30<\/strong>: d.velop fixed the vulnerability.<\/li>\n<li><strong>2025-05-13<\/strong>: d.velop released fixed versions 7.30.13 and 7.33.3<\/li>\n<\/ul>\n<h3>Credits<\/h3>\n<p><!-- add the names of the persons that discovered the vulnerability. This information will be sent to the vendor and published on the HeroLab blog -->This security vulnerability was identified by Konstantin Samuel of usd AG.<\/p>\n<p>&nbsp;<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2025-0019 | d.3one 1.14.16 - Reflective Cross-Site Scripting Product: d.3oneAffected Version: 1.14.16Vulnerability Type: Cross-Site Scripting (CWE-79)Security Risk: HighVendor: d-velopVendor URL: https:\/\/www.d-velop.de\/Vendor acknowledged vulnerability: YesVendor Status: Fixed in version 7.30.13 and 7.33.3CVE Number: RequestedCVE Link: -Advisory ID: usd-2025-0019 Description By activating a malicious link, it is possible to execute JavaScript in the victim's browser. This can [&hellip;]<\/p>\n","protected":false},"author":119,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-24414","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/24414","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/119"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=24414"}],"version-history":[{"count":5,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/24414\/revisions"}],"predecessor-version":[{"id":24541,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/24414\/revisions\/24541"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=24414"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}