Stored XSS via LINK Name.

How it was found

Summary:

Hi Team,

The LINK NAME is not properly escaped at the Templates page leading to Stored XSS and the name is reflected in the <script> tag , due to lack of sanitization the user can break out of the <script> tag and execute the XSS.

See Proof Of Concept below. Thank You.

Steps To Reproduce:

A. Log into your account at https://marketing.na1.insightly.com/

B. Click on Plus Sign --> Add a new redirect Link

C. Enter this '"></script><img src=x onerror=alert(1)>{{'7'*7}} payload in the Link Name and fill all other details.

D. Click on Save and click on Emails Icon --> Email Templates --> New Email Templates

E. Enter all the details and click on Save

Wait a little bit and you will see the XSS executing.

Note all the users visiting that page will execute the XSS in the organization.

Proof Of Concept:

See this Video POC:

{F1504350}

POC:

{F1504349}

Impact

An XSS attack allows an attacker to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.