Submit #50338: Unauthenticated Stored XSS in apinto-dashboard <= v1.1.0-beta via callback, username
| Title | Unauthenticated Stored XSS in apinto-dashboard <= v1.1.0-beta via callback, username |
|---|---|
| Description | # Get start repo: https://github.com/eolinker/apinto-dashboard 1,Download and unzip the installation package Apinto 2,Start gateway 3,Download and unzip the installation package Apinto Dashboard 4,Start Apinto Dashboard ```bash wget https://github.com/eolinker/apinto/releases/download/v0.8.0/apinto-v0.8.0.linux.x64.tar.gz && tar -zxvf apinto-v0.8.0.linux.x64.tar.gz && cd apinto ./apinto start cd .. wget https://github.com/eolinker/apinto-dashboard/releases/download/v1.1.0-beta/apinto-dashboard-v1.1.0-beta.linux.x64.tar.gz && tar -zxvf apinto-dashboard-v1.1.0-beta.linux.x64.tar.gz && cd apinto-dashboard ./apinto-dashboard ``` # Unauthenticated Stored XSS While user loging, the wrong user name and callback parameter will be recorded in the activity log, but the output parameters are not escaped correctly, external attacker can inject arbitrary js code. poc: open /login?callback=/<img src=1 onerror=alert(/2nd-xss/)> enter `<img src=1 onerror=alert(/1st-xss/)>` at the username   then open /activity-log   |
| User | Tomy (ID 34751) |
| Submission | 01.11.2022 11:54 (1 Year ago) |
| Moderation | 01.11.2022 16:50 (5 hours later) |
| Accepted | Akzeptiert |
| VulDB Entry | VDB-212640 |