open-webul open-webul SSRF/Session Hijacking Vulnerability (GHSA-vgp8-f445-hcq7) Analysis

Vulnerability Overview Any website can steal the session tokens of logged-in users via the community status message handler. This vulnerability affects the package, specifically identified as . Affected Versions Affected Versions: >= 0.7.0, < 0.11.4 Patched Version: 0.11.4 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None Mitigation Patched Version: 0.11.4 Changes in Patch: - The listener now ignores any messages where is not a known community source. - Replies are only sent to validated sources, and chat content is URL-encoded using . - Upgrading to version 0.11.4 fully resolves the issue with no further configuration required. Proof of Concept (POC) Additional Information Prerequisites: - Community sharing is enabled ( , default ), which mounts the sync status modal and its message listener. - The victim is logged into Open Webul in the same browser and visits an attacker-controlled page that opens Open Webul in a popup. Deployments with community sharing disabled are not affected. Impact: - The attacker can post messages containing path traversal. The listener inserts these unencoded into . The browser normalizes this to and sends the victim's bearer token. The listener then sends the response back to the opener with the target origin, allowing the attacker to receive the victim's identity and JWT. This token can be used from any client with only the header, granting full API access, including private chats and all authenticated actions, acting on behalf of the victim. The demonstrated victim held the standard user role. Root Cause: - hosts the message handler and constructs the request URL in . Whenever community sharing is enabled, the handler is mounted on every page. The listener remains active even if the modal is hidden. While an existing origin allowlist protects other community message handlers, one does not exist here. Additionally, chat content is concatenated into the path without encoding, allowing attacker-chosen values from untrusted sources to be accepted and redirect authenticated requests to different endpoints. Credits Reporter: zyakir13 Patch Developer: Classic298 References GitHub Repository CVE Information

Goal Reached Thanks to every supporter — we hit 100%!

open-webul open-webul SSRF/Session Hijacking Vulnerability (GHSA-vgp8-f445-hcq7) Analysis

More from this source