eramba Enterprise / Community Cross Site Scripting
Posted on 16 December 2016
# Exploit Title: eramba Enterprise & Community Editions Stored XSS # Author: Yunus YILDIRIM (Th3GundY) # Team: CT-Zer0 (@CRYPTTECH) - https://www.crypttech.com # Website: www.yunus.ninja # Contact: yunusyildirim@protonmail.com 1. ADVISORY INFORMATION ======================= Product: eramba Open-Source IT GRC Description: eramba is a web-application that helps with the analysis, management and reporting of Security, Governance, Risk and Compliance challenges. Founded in 2011 and followed by a community of tens of thousands, we are building the leading open-source GRC application on Internet. Vendor URL: http://www.eramba.org Download Link: http://www.eramba.org/resources/download/ 2. VULNERABILITY SUMMARY ======================== Stored XSS in Notification Page. eramba is vulnerable to a stored XSS when an user created Notifications with an malicious payload on the "Notification Name" field. The html/javascript payload is executed when another user tries to use the see Notifications. 3. TECHNICAL DETAILS ======================== Stored XSS in Notification Page. eramba is vulnerable to a stored XSS when an user created Notifications with an malicious payload on the "Notification Name" field. The html/javascript payload is executed when another user tries to use the see Notifications. 4. PROOF OF CONCEPT ======================== PoC for Enterprise or Community Edition: 1- Go, System - Settings - Notifications menu or Just go http://<eramba-IP>/notificationSystem/attach/Project 2- Click Manage button 3- Add Warning or Add Awareness or Add Default. You can select anyone of them. 4- In "Notification Name" field, here is the payload "><svg/onload=prompt(/CT-Zer0/)> 5- Save it, you see pop-up /notificationSystem/index/Project PoC Video: https://www.youtube.com/watch?v=03xNMcpXqTs 5. AFFECTED VERSIONS ==================== Community Edition <= c1.0.6.001 Enterprise Edition <= e1.0.6.018 Vulnerability Disclosure Timeline: ========================= 29/11/2016 - Contact With Vendor 30/11/2016 - Vendor Response 14/12/2016 - Public Dislosure
