Security Issues on Eramba
some CVEs found by me and my bros 2018 when i was a Jr
Last updated
some CVEs found by me and my bros 2018 when i was a Jr
Last updated
Me and my coworkers Kelvin Clark and Lucas Carmo, security researchers, found some security issues on the IT Governance, Risk & Compliance application, Eramba
XSS Storaged
XSS Reflected on the import CSV error page
XSS Reflected on date filter
XSS Reflected Search Parameter
First i would like to explain a bit about Cross Site Scripting (XSS)
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.
On the Proofs of concept reported below i’ve put a script tag with the alert screen showing the Int 1, just to illustrate the issue. Normally a Attacker would put the variable document.cookie, for receiving the session cookie of the user!
Being said that, let’s start the report!
1- XSS Storaged
The payload used was: <”img src=”” onerror=”alert(1);”>
2- XSS Reflected on the import CSV error page
The payload used was: <script>alert(1)</script>
3- XSS Reflected on date filter
The payload used was <script>alert(2)</script>
4- XSS Reflected Search Parameter
The payload used was <script>alert(1)</script>
CVEs Related to this Post:
CVE-2018–7996
CVE-2018–7997
CVE-2018–7894
CVE-2018–7741
For more reading about the issue,
The first cross site script was on the tooltipbox on the
The Second Cross Site Script was on the , in the error page while importing a CSV with a HTML script tag inbued on the file.
the Third was found in the /crons?advanced_filter=1&created__comp_type=0&created=%3Cscript%3Ealert(2)%3C%2Fscript%3E&created__show=1&type__show=1&execution_time__comp_type=0&execution_time__show=1&status__show=1&_limit=15
The fourth was found in on the >/reviews/filterIndex/ThirdPartyRiskReview? in the parameter advanced_filter.
