GoCD · Report #2433634

XSS in GOCD Analytics Plugin

Validstatus

mediumseverity

29upvotes

27 Mar 2024disclosed

Summary

The gocd/gocd-analytics-plugin in info-message.js at line 28 contains a Cross-Site Scripting (XSS) vulnerability, which can be exploited via the ?msg= parameter. Attackers can inject malicious payloads, such as ?msg=%3Csvg%2Fonload%3Dalert%28%22XSS%22%29%20%3E, which inserts <svg/onload=alert("XSS") > into the webpage.

How it was found

gocd/gocd-analytics-plugin (info-message.js#L28) is vulnerable to XSS via the ?msg= parameter. By supplying an attack payload such as ?msg=%3Csvg%2Fonload%3Dalert%28%22XSS%22%29%20%3E, <svg/onload=alert("XSS") > will be injected into the webpage.

$(document).ready(function () {
  const msg = window.location.search.match(/[&?]msg=([^&]+)/);
  const msgText = msg ? decodeURIComponent(msg[1]) : "No data collected for this metric, cannot generate analytics.";

  $(document.body).html(Utils.infoMessage(msgText));
});

Utils.infoMessage basically just wraps msgText in a </p>

Impact

An attacker can run malicious code on servers running this plugin, comprising the integrity and confidentiality of such servers.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original