/emgui/rest/ums/messagesmessageWhile assessing the Ingenico Estate Manager during a client engagement. It was possible to discover a stored Cross-Site Scripting (XSS) vulnerability in the news feed feature managed by an administrator account. The vulnerability is in the href attribute of a link when a new message is posted. An attacker can leverage this vulnerability to inject malicious Javascript code in the context of the browser of a victim that can be triggered with one click on the link.
An attacker with enough privileges to add a message to the news feed can attach a link to the message as a reference. The link is composed of 2 parts ;the Alias and the URL. The URL part is missing sanitization to prevent injecting javascript code in the href attribute.
As shown in the screenshot above, an XSS payload is injected in the “Link” input field.
The raw HTTP request to post the message looks like below:
The application is using the syntax: message[link_alias|link_URL] as shown above.
Then, when the victim receives the message in the news feed section on the dashboard. The attack payload will look like a normal link as shown below:
Upon clicking on the link, the javascript code will be triggered and a popup alert will appear.
