| Título | sunkaifei FlyCms master Improper Neutralization of Alternate XSS Syntax |
|---|
| Descripción | Stored XSS: Lack of input sanitization during content submission and failure to escape output on the detail page.
In short: Any registered user can inject a `<script>` tag into the body of a post. Once the post is published, the script executes in the browser of any visitor who views the detail page.
The vulnerability stems from two combined oversights:
| Stage | Code Location | Issue |
| :--- | :--- | :--- |
| Data Ingestion | `ModelDataService#insertData:474` | Only external images are downloaded locally; no HTML sanitization (e.g., via Jsoup) is performed. |
| Data Output | `articles/detail.html:28` (and 19 other locations) `${(info.content)!''}` | The `?html` escape directive is missing, and the template engine does not escape content by default. |
Key prerequisites:
• Registration is open, and the submission endpoint only verifies the user's login status.
• The `content` field is included in the allowed-field whitelist.
• The `fly_model` table lacks an `enable_submit` column, meaning this validation check always passes.
• The configuration `fly_article_audit = '0'` results in `status = "1"`, allowing posts to be published immediately without undergoing moderation.
Verification: Testing with the actual FreeMarker 2.3.32 engine and the production template files confirms that the payload is rendered exactly as provided. In contrast, using `.ftlh` files or explicitly adding `?html` correctly escapes the content. The root cause of this discrepancy is that the `outputFormat` is set to `undefined`; the `<#ftl output_format="HTML">` directive defined in `spring.ftl` is not being propagated to the page templates.
Impact: Attackers can hijack visitor sessions, perform administrative actions, or conduct phishing attacks. There is no `script-src` policy defined in the Content Security Policy (CSP), leaving no fallback protection. |
|---|
| Fuente | ⚠️ https://github.com/sunkaifei/FlyCms/issues/18 |
|---|
| Usuario | s1mple_xy (UID 82894) |
|---|
| Sumisión | 2026-10-18 17:32 (hace 22 días) |
|---|
| Moderación | 2026-11-09 18:11 (22 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 433192 [sunkaifei FlyCMS hasta e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a Content Rendering articles/detail.html ModelDataService.insertData content secuencias de comandos en sitios cruzados] |
|---|
| Puntos | 20 |
|---|