search

thingsboard / thingsboard

Open-source IoT Platform - Device management, data collection, processing and visualization.
https://thingsboard.io
Apache License 2.0
16.89k stars 5.04k forks source link

[Bug] Reflected HTML injection via outdated swagger #8411

Closed mathiasbosman closed 3 months ago

mathiasbosman commented 1 year ago

Describe the bug

they have found that you are able to load your own content from example https://gist.githubusercontent.com/0xdln1/T his prompt is being served from an arbitrary location (authorization.site), which can be modified as needed to be as convincing as possible to any possible victim. Imagine yourdomain.authorization.site, for example. Depending on the browser being used, a message can be included along with the prompt to make it seem more trustworthy. When a victim enters their information into the prompt, it is sent to the arbitrary location being used by the attacker (authorization.site) along with their IP address, and stored in plain text for the attacker to use when desired?

Your Server Environment

Your Client Environment Desktop (please complete the following information):

To Reproduce Steps to reproduce the behavior:

  1. Go to 'http://demo.thingsboard.io/swagger-ui/index.html?configUrl=https://gist.githubusercontent.com/0xdln1/8a89b4530eb3110e678bc1982bf38921/raw/e64def6b8fa2bb1b77c64cc2af3c61bb8321d1be/ext-injection.json'
  2. Click on the link on top

Additional context This vulnerability was reported to us via a BugBounty program.

ssakharova commented 3 months ago

Hello @mathiasbosman,

The issue described is no longer relevant, as it has already been fixed. Thank you for highlighting the problem.