Assigned my First CVE-2020–28726!!

In this blog post, I’ll be sharing about how I was assigned my CVE :)

I was reading a blog post by Nimit Jain about his findings on an Open Source software which is “SeedDMS” and he inspired me to give a look at this software and see if I can find some bugs and get myself a CVE. So, This blog post is regarding the first finding which was initially an HTML Injection but then converted it into an Open Redirect.

What is SeedDMS?

SeedDMS is a free document management system with an easy to use web based user interface for small and medium sized enterprises.

SeedDMS has a demo portal which helped me to save time in installing it on my local machine. So I fired up my machine, turned on the proxy, and started using the SeedDMS as a normal user.

I interacted with a couple of functionalities while monitoring all the requests in my Burp suite’s Flow extension which is really a good extension to monitor the URLs going through your burp proxy. Coming back to the topic

I found an endpoint while uploading a document /out/out.AddDocument.php with dropfolderfileform1 as a parameter which was not sanitizing the special characters I put in. I tried XSS but no luck but the HTML injection was working fine, there’s nothing much I was able to do with simple HTML Injection. I started looking if I can escalate it into something impactable and found this helpful blogpost by Akita.

Hunting Good Bugs with only <HTML>

which helped me to reconstruct my simple HTML injection into an Open redirect with the help of meta tag.

Now when the logged-in user visits the malicious URL to upload a document he gets redirected to the attacker’s controlled website.

Takeaway

When finding bugs, you must look into each URL and try to escalate the bug which may impact the User.

Thanks to the Vendor for quick enough to patch it on the same day as the report was sent and issued an update for the same.

That’s all for this blog. Hope you liked it.

Connect with me on LinkedIn, Twitter

If you enjoyed this blog, please click the 👏 button and share it to help others find it.