Submitty 20.04.01 - Persistent Cross-Site Scripting

vendor:

Submitty

by:

humblelad

5.4

CVSS

MEDIUM

Persistent Cross-Site Scripting

CWE

Product Name: Submitty

Affected Version From: 20.04.01

Affected Version To: 20.04.01

Patch Exists: YES

Related CWE: CVE-2020-12882

CPE: 2.3:a:submitty:submitty:20.04.01

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Mac Os Catalina

2020

Submitty 20.04.01 – Persistent Cross-Site Scripting

Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow. This vulnerability can potentially enable any student to takeover the account of TA if they open the attachment as the cookie gets exposed. To exploit this vulnerability, a student must login, go to a gradeable page, and upload a malicious SVG file with any XSS payload. The TA must then open the same page for grading, which will trigger the XSS payload.

Mitigation:

Ensure that all user-supplied input is properly sanitized and validated before being used in the application.

Source

Exploit-DB raw data:

# Exploit Title: Submitty 20.04.01 - Persistent Cross-Site Scripting
# Date: 2020-05-15
# Exploit Author: humblelad
# Vendor Homepage: http://submitty.org/
# Software Link: https://github.com/Submitty/Submitty/releases
# Version: 20.04.01
# Tested on: Mac Os Catalina
# CVE : CVE-2020-12882


Description:
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated
by an attack by a Student against a Teaching Fellow.This vulnerability can potentially enable any student to takeover the account of TA if they open the attachment as the cookie gets exposed.

1.As student login, via student:student

2.Go here http://localhost:1501/s20/tutorial/gradeable/01_simple_python (as ex.)

3.In the new submission upload the  malicious .svg file with any xss payload.

	

Login as ta and open the same for grading. The XSS gets triggered alerting the cookies.