CVE-2019-17625 PoC — Rambox 跨站脚本漏洞

Source

https://github.com/Ekultek/CVE-2019-17625

Associated Vulnerability

Title: Rambox 跨站脚本漏洞 (CVE-2019-17625)
Description:There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element.

Description

Working exploit code for CVE-2019-17625

Readme

# CVE-2019-17625

There is a stored XSS vulnerability in rambox 0.6.9 due to unsantized parameters in the name field when a user is adding a service. Since rambox runs on NodeJS this allows for the use of OS commands to be injected into an `<a>` or `<img>` tag.

_Note:_ This code has only been tested on MacOS and may need to be reconfigured for other operating systems

# Exploit code

The exploit code will create a service (using discord as a base), the shell requires that the system has `mkfifo` on it. You can of course swap out the payload for whatever you want.

# PoC

![rce_rambox_poc](https://user-images.githubusercontent.com/14183473/66883875-fb30fa00-ef94-11e9-82a0-589006c453a9.gif)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →