Incorrect Behavior Order in Pentestify CSS Sanitizer Allows Outbound HTTP Requests

Executive Summary

This is a medium-severity vulnerability in Pentestify versions 1.2.0 through 2.3.2 where an authenticated but non-privileged user can bypass CSS sanitization. The flaw allows attackers to force outbound HTTP requests from other users' browsers by using CSS hex escapes to reconstruct the url() function, evading the sanitizer's blocklist. This happens because browsers resolve escapes before parsing functions, unlike the sanitizer which checks uncanonicalized text.

Useful 0 Not Useful 0

Detection Guidance

Check Pentestify installations for versions 1.2.0 through 2.3.2. Inspect CSS in report themes or global settings for hex escapes like \75 rl(...) that reconstruct url() functions. Review network logs for unexpected outbound HTTP requests from user browsers.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to disclose victims' IP addresses and User-Agent strings to a server under their control. This requires only authentication and no further user interaction. The impact includes potential privacy breaches and unauthorized network requests from users' browsers.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's privacy rules. It may result in non-compliance due to potential IP address and User-Agent disclosure without user consent.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch from commit 1ed1aad to backend/schemas.py. Upgrade to the first fixed version once released. Manually review and re-sanitize existing themes to remove malicious CSS escapes. Restrict PUT /api/settings access to trusted users only.

Useful 0 Not Useful 0