{"schema_version":"1.7.3","id":"GHSA-wvv7-wm5v-w2gv","published":"2024-11-05T15:18:05Z","modified":"2024-11-06T19:55:13Z","aliases":["CVE-2024-51735","GO-2024-3254"],"summary":"Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE","details":"### Summary\nXSS occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server.\n\n### Details\nWhen using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The default report is based on the `general-template.md` template.\n\n```\n

\n \"Osmedeus\"\n
\n
\n Execute Summary Generated by Osmedeus {{Version}} at {{CurrentDay}}\n\n

\n \n \n \n

\n

\n\n## Scan Information \n\n\n\n***\n\n## 🚀 Subdomains\n\n\n\n***\n\n## 🌐 HTTP Fingerprint\n\n\n\n***\n\n## 🐞 Vulnerability\n\n### List of Vulnerability Reports\n\n- [**{{Workspace}}-report.html**]({{Output}}/vuln/active/{{Workspace}}-report.html)\n- [**{{Workspace}}-sensitive.html**]({{Output}}/vuln/sensitive/{{Workspace}}-sensitive.html)\n- [**{{Workspace}}-nuclei.html**]({{Output}}/vuln/nuclei/{{Workspace}}-nuclei.html)\n\n### Jaeles Scan\n\n\n\n\n\n***\n\n### Nuclei Scan\n\n\n\n***\n\n## 🕷️ Spider Content\n\n\n\n***\n\n## 📃 Content Discovery\n\n\n\n***\n\n\n## 🔍 Port Scan\n\n\n\n\n***\n```\n\nThe contents of the files are read and used to generate the report. However, the file contents are not properly filtered, leading to XSS\nThe issue starts with processing the tags, and XSS occurs when the extendTag function is called.\n\nhttps://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L36\nhttps://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L95\nhttps://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L114\nhttps://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L122-L124\n\nThe condition to enter this if branch must meet one of the following cases:\n\n* Tag shorten=true: In the default template, only subdomains have this tag ⇒ Subdomains cannot contain special characters, so XSS is not possible.\n* len(fileContent) > r.Opt.MDCodeBlockLimit: Simply put, the content length needs to exceed the MDCodeBlockLimit configuration (default is 10,000).\n\nAfter reviewing the files loaded in the default template, we select Spider Content because it meets the conditions:\n\n* It can contain special characters since the spider retrieves results through Katana ⇒ Katana parses content based on tags ⇒ We can create custom payloads by leveraging this mechanism.\"\n```\n \n\n\n\n\nDirectory listing for /\n\n\n

Directory listing for /

\n
\n\n
\n\n\n```\n* Easily bypass the condition len(fileContent) > r.Opt.MDCodeBlockLimit\n* Spider is a module within the general workflow ⇒ a default workflow that is most commonly used\n\n### PoC\n\nhttps://drive.google.com/file/d/1u-YowfzFV1tUqLaZk4s4Y1DykFhJZ8gR/view?usp=sharing\n\nPayload RCE\n\n``\n\nFile index payload\n```\n\n\n\n\n\nDirectory listing for /\n\n\n

Directory listing for /

\n
\n\n
\n\n\n\n```\n\n### Impact\nExecute command on server\n","affected":[{"package":{"name":"github.com/j3ssie/osmedeus","ecosystem":"Go","purl":"pkg:golang/github.com/j3ssie/osmedeus"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.6.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-wvv7-wm5v-w2gv/GHSA-wvv7-wm5v-w2gv.json"}}],"references":[{"type":"WEB","url":"https://github.com/j3ssie/osmedeus/security/advisories/GHSA-wvv7-wm5v-w2gv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51735"},{"type":"WEB","url":"https://drive.google.com/file/d/1u-YowfzFV1tUqLaZk4s4Y1DykFhJZ8gR/view?usp=sharing"},{"type":"PACKAGE","url":"https://github.com/j3ssie/osmedeus"}],"database_specific":{"cwe_ids":["CWE-78","CWE-79"],"github_reviewed":true,"github_reviewed_at":"2024-11-05T15:18:05Z","nvd_published_at":"2024-11-05T19:15:07Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N"}]}