Submit #658910: ReBuild (RB Enterprise Management System) RB Enterprise Management System (ReBuild) Affected Versions: ≤ 4.1.3 (confirmed vulnerable) Stored Cross-Site Scripting (Stored XSS)

Stored XSS in frontend comment/guestbook functionality of RB Enterprise Management System (≤4.1.3) — attacker can store JavaScript in user comments which executes when viewed by administrators or other users.

Full description:
A stored cross-site scripting (XSS) vulnerability exists in RB Enterprise Management System (ReBuild) versions up to and including 4.1.3. An unauthenticated attacker can register a frontend account and post crafted payloads in the site’s public comment/guestbook fields. The submitted content is stored and later rendered without proper output escaping or sanitization; when an administrator or any user views the comment, the injected JavaScript executes in the victim’s browser context. This can lead to cookie theft, session hijacking, CSRF via the administrator’s session, or other arbitrary client-side attacks.

Proof of Concept / Reproduction steps:
1. Register a frontend user account on the target installation.
2. Login with the new user and navigate to the public comment / guestbook input area.
3. Submit the following payload as a comment (example PoC):
<svg/onload=alert(document.cookie)>
4. Log out (or use a different browser) and view the comment page as an administrator or another authenticated user. The payload executes when the page renders, demonstrating stored XSS.

Observed impact:
• Execution of arbitrary JavaScript in the context of any viewer (including administrators).
• Potential disclosure of document.cookie and other sensitive client data.
• Possible session hijacking, privilege escalation via the admin interface, persistent site compromise (if attacker can inject scripts that persist or perform actions using admin privileges).

Vendor communication / timeline:
• I reported the issue to the vendor and received a reply in the project issue system. The vendor’s reply indicated the issue was fixed in version 4.1.4. The vendor marked their reply private (visible only to reporter and vendor). (If you need exact dates or copied messages, I can attach screenshots or the private reply as an attachment.)

Mitigation / Fix recommendation:
• Escape output when rendering any user-supplied content (HTML entity encode <, >, &, " etc.).
• Implement contextual output encoding for HTML content.
• If HTML markup must be allowed, use a strict allowlist sanitizer (e.g., HTMLPurifier or equivalent) and disallow inline event handlers and <svg> tags that can execute JS.
• Apply server-side validation and remove or neutralize potentially dangerous tags/attributes before storage.
• Ensure admin views and any summary widgets also perform output encoding.

References:
• Source repository: https://gitee.com/getrebuild/rebuild
• PoC example: <svg/onload=alert(document.cookie)> (submit in comment box)

• User: BlackSpdier (UID 89912)
• Submission: 09/19/2025 09:46 (11 months ago)
• Moderation: 10/04/2025 08:07 (15 days later)
• Status: Accepted
• VulDB entry: 327010 [Rebuild up to 4.1.3 Comment/Guestbook cross site scripting]
• Points: 17