FirstBlood-#425 — Stored XSS in cancelled appointments message functionality
This issue was discovered on FirstBlood v2

On 2021-10-25, sumyth Level 2 reported:

Hi,

Please find a brief description of the vulnerability below,

In firstblood.com, users having prior appointments are given an option to cancel it along with a message which then is shown to the doctor in doctor's panel. The message parameter is vulnerable to stored XSS.

Steps to reproduce:

  1. Cancel a previously booked appointment and capture the request using burp.

  2. In the captured request, modify the message parameter and add the payload as shown below and forward the request to server.

  1. Observe that the server responds with a 200 OK 'success' message. Login as drAdmin and check the cancelled appointments section. Observe that the payload is executed.

Impact

Stored XSS along with unprotected session cookies can allow an attacker to perform account takeover without any kind of user interaction.

P2 High

Endpoint: /api/ma.php

Parameter: message

Payload: "</a><script>alert(document.cookie)</script>

FirstBlood ID: 22
Vulnerability Type: Stored XSS

Whilst an attempt was made to fix the stored XSS vulnerability in managing an appointment, it actually introduced new issues such as when creating and editing and not just when cancelling the appointment. Making use of htmlentities() and relying on .value() in javascript to encode certain characters does not prevent XSS overall. The 'fix' to this issue also results in it being vulnerable to admins on cancelled appointments as well.