Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in the O2OA application up to version 10.0-410. It occurs in the endpoint /x_cms_assemble_control/jaxrs/form, where user inputs in personal profile fields are stored without proper sanitization. Malicious JavaScript code can be embedded in these fields and later executed in the browsers of users who view the affected profiles, allowing persistent script execution. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers to execute persistent malicious JavaScript in users' browsers, which can lead to theft of session tokens or sensitive data and enable unauthorized actions on behalf of authenticated users. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending crafted POST requests to the endpoint `/x_cms_assemble_control/jaxrs/form` with JSON data containing typical XSS payloads in fields such as "name", "alias", and "description". For example, you can use curl to send a test payload: curl -X POST -H "Content-Type: application/json" -d '{"name":""><img src=1 onerror=alert(1)>","alias":"test","description":"test"}' http://<target>/x_cms_assemble_control/jaxrs/form. Monitoring responses and checking if the payload is stored and executed when viewing the profile page indicates vulnerability. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing input filtering and escaping for all user-supplied data before storage, and ensuring proper output encoding when rendering data in the application to prevent script execution. Additionally, updating to a fixed version of the software once available is recommended. [1]

Useful 0 Not Useful 0