Stored XSS in BuildAdmin via X-Rewrite-URL Header

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in BuildAdmin versions 1.0.1 through 2.3.9. Unauthenticated attackers can inject malicious JavaScript URLs into the admin operation log by manipulating the X-Rewrite-URL header. When an administrator clicks the log entry's URL, the script executes in the backend origin, stealing the adminInfo token from localStorage and enabling account takeover.

Useful 0 Not Useful 0

Detection Guidance

Check BuildAdmin admin logs for suspicious JavaScript URLs in the X-Rewrite-URL header entries. Inspect network traffic for unauthenticated requests containing malicious payloads in the X-Rewrite-URL header targeting admin interfaces.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control of an administrator's account by stealing session tokens. This could lead to unauthorized access to sensitive data, system manipulation, or further attacks within the application. Exploitation requires an administrator to interact with the malicious log entry.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, and failure to maintain confidentiality of sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade BuildAdmin to a patched version beyond 2.3.9. If immediate upgrade is not possible, disable logging of the X-Rewrite-URL header or implement strict input validation to sanitize URLs before storing them in admin logs.

Useful 0 Not Useful 0