NeverStopExploiting用户9473
Stored XSS in Forest <= 0.0.5 User Profile
输入“/”快速插入内容
Stored XSS in Forest <= 0.0.5 User Profile
Stored XSS in Forest <= 0.0.5 User Profile
用户9473用户94732月10日修改
BUG_Author: ChengxinXu
Affected Version: Forest (<= 0.0.5 version defined from pom.xml)
Vulnerability Files:
•
src/main/java/com/rymcu/forest/service/impl/UserServiceImpl.java
•
src/main/java/com/rymcu/forest/web/api/user/UserInfoController.java
•
src/main/java/com/rymcu/forest/mapper/UserMapper.java
Description
Forest <= 0.0.5 contains a stored XSS vulnerability in the user profile update functionality. The signature fields are not sanitized before storage, allowing authenticated attackers to inject malicious JavaScript code that executes when other users view the attacker's profile.
When a user updates their profile information, the request flows through multiple layers without XSS filtering:
Entry Point (UserInfoController.java:57-62):
代码块
@PatchMapping("/update")
@SecurityInterceptor
public GlobalResult<UserInfoDTO> updateUserInfo(@RequestBody UserInfoDTO user) throws ServiceException {
user = userService.updateUserInfo(user); // User-controlled input
return GlobalResultGenerator.genSuccessResult(user);
}
The nickname and signature fields from UserInfoDTO are passed to UserService.updateUserInfo() without any XSS filtering.
Vulnerable Code (UserServiceImpl.java:189-211):
Root Cause:
User profile fields (nickname and signature) are stored directly in the database without any XSS filtering.
When other users view the profile at /api/v1/user/{account}, the malicious payload is rendered in the frontend, executing arbitrary JavaScript.
Proof of Concept
Prerequisites
•
Authenticated user account
Step 1: Login
Login from frontend: admin:admin
Step 2: Exploit XSS via User Profile Update