Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page
Date: 2024-10
Affected: npm/@saltcorn/server
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

### Summary Event log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability. ### Details - file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/eventlog.js#L445 ```js router.get( "/:id", isAdmin, error_catcher(async (req, res) => { const { id } = req.params; const ev = await EventLog.findOneWithUser(id); send_events_page({ [...] contents: { type: "card", contents: [...] ) + div( { class: "eventpayload" }, ev.payload ? pre(JSON.stringify(ev.payload, null, 2)) : "" //<--- ), }, }); }) ``` ### PoC The following PoC demonstrates how a non-admin user with permission to read/write on a table can inject malicious javascript code that will be executed in the event log admin panel if event logs are enabled. To demonstrate this issue, we need to prepare some components. The following steps should be executed with an admin user. 1. create a table with one column of type string set read/write permission to staff users (just as an example) - visit `http://localhost:3000/table/new` - create a table with `Table name` `my_table_xss` and click `Create` - click `Add field` to add a field with `Label` called `payload` of type `String` and click `Next >>` - leave default values for `Attributes` and click `Next >>` - it should redirect to `http://localhost:3000/table/<table-number>` - under


Mitigations:

Architectural layers (MAESTRO):