OpenXE Cross-Site Scripting Vulnerability in Ticket Bearbeiten Page

A cross-site scripting (XSS) vulnerability has been identified in OpenXE versions through 1.12. This issue arises in the Ticket Bearbeiten Page, where the Notizen argument can be manipulated to inject malicious scripts. The vulnerability can be exploited remotely, requiring user interaction from the victim. Successful exploitation could lead to session hijacking by stealing cookies from higher-privileged users.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts can be executed in the context of the user's browser. This could result in session hijacking by stealing cookies, particularly if the security flags on those cookies are not properly set.

Reproduction

To reproduce this vulnerability, log into OpenXE v1.12 with a user account that has permission to create tickets. Once logged in, navigate to the ticket creation page and enter a payload into the Notizen field. This payload should include an image tag with an 'onerror' event that triggers a request to a server you control, including the document's cookies. After submitting the ticket, have a higher-privileged user open the ticket overview, which will activate the payload and send the cookies to your server.

Remediation

To address this vulnerability, OpenXE should sanitize and properly escape all user inputs to prevent script injection. Implementing a Content Security Policy (CSP) could also help mitigate XSS risks. Additionally, setting secure cookie flags, such as HttpOnly, Secure, and SameSite=Strict, would protect cookies from being accessed by malicious scripts.