CVE-2024-51735

Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. When using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The default report is based on the general-template.md template.The contents of the files are read and used to generate the report. However, the file contents are not properly filtered, leading to XSS. This may lead to commands executed on the host as well. This issue is not yet resolved. Users are advised to add their own filtering or to reach out to the developer to aid in developing a patch.

Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. When using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The default report is based on the general-template.md template.The contents of the files are read and used to generate the report. However, the file contents are not properly filtered, leading to XSS. This may lead to commands executed on the host as well. This issue is not yet resolved. Users are advised to add their own filtering or to reach out to the developer to aid in developing a patch.

Summary

XSS occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server.

Details

When using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The default report is based on the general-template.md template.

<p align="center">
  <a href="https://www.osmedeus.org"><img alt="Osmedeus" src="https://raw.githubusercontent.com/osmedeus/assets/main/logo-transparent.png" height="140" /></a>
  <br />
  <br />
  <strong>Execute Summary Generated by Osmedeus {{Version}} at <em>{{CurrentDay}}</em></strong>

  <p align="center">
  <a href="https://docs.osmedeus.org/"><img src="https://img.shields.io/badge/Documentation-0078D4?style=for-the-badge&logo=GitBook&logoColor=39ff14&labelColor=black&color=black"></a>
  <a href="https://docs.osmedeus.org/donation/"><img src="https://img.shields.io/badge/Donation-0078D4?style=for-the-badge&logo=GitHub-Sponsors&logoColor=39ff14&labelColor=black&color=black"></a>
  <a href="https://twitter.com/OsmedeusEngine"><img src="https://img.shields.io/badge/%40OsmedeusEngine-0078D4?style=for-the-badge&logo=Twitter&logoColor=39ff14&labelColor=black&color=black"></a>
  </p>
</p>

## Scan Information 

<scanInfo />

***

## 🚀 Subdomains

<content src="{{Output}}/subdomain/final-{{Workspace}}.txt" shorten=true />

***

## 🌐 HTTP Fingerprint

<content src="{{Output}}/fingerprint/beautify-{{Workspace}}-http.txt" />

***

## 🐞 Vulnerability

### List of Vulnerability Reports

- [**{{Workspace}}-report.html**]({{Output}}/vuln/active/{{Workspace}}-report.html)
- [**{{Workspace}}-sensitive.html**]({{Output}}/vuln/sensitive/{{Workspace}}-sensitive.html)
- [**{{Workspace}}-nuclei.html**]({{Output}}/vuln/nuclei/{{Workspace}}-nuclei.html)

### Jaeles Scan

<content src="{{Output}}/vuln/active/jaeles-summary.txt" />

<content src="{{Output}}/vuln/sensitive/jaeles-summary.txt" />

***

### Nuclei Scan

<content src="{{Output}}/vuln/nuclei/{{Workspace}}-nuclei-scan.txt" />

***

## 🕷️ Spider Content

<content src="{{Output}}/linkfinding/links-{{Workspace}}.txt"/>

***

## 📃 Content Discovery

<content src="{{Output}}/directory/unique-beautify-{{Workspace}}.txt" />

***


## 🔍 Port Scan

<content src="{{Output}}/portscan/open-ports.txt" />


***

The contents of the files are read and used to generate the report. However, the file contents are not properly filtered, leading to XSS The issue starts with processing the <content> tags, and XSS occurs when the extendTag function is called.

https://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L36 https://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L95 https://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L114 https://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L122-L124

The condition to enter this if branch must meet one of the following cases:

• Tag shorten=true: In the default template, only subdomains have this tag ⇒ Subdomains cannot contain special characters, so XSS is not possible.
• len(fileContent) > r.Opt.MDCodeBlockLimit: Simply put, the content length needs to exceed the MDCodeBlockLimit configuration (default is 10,000).

After reviewing the files loaded in the default template, we select Spider Content because it meets the conditions:

• It can contain special characters since the spider retrieves results through Katana ⇒ Katana parses content based on <a> tags ⇒ We can create custom payloads by leveraging this mechanism."

 <! -- Fake Index Content --> 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Directory listing for /</title>
</head>
<body>
<h1>Directory listing for /</h1>
<hr>
<ul>
<li><a…

Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. When using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The default report is based on the general-template.md template.The contents of the files are read and used to generate the report. However, the file contents are not properly filtered, leading to XSS. This may lead to commands executed on the host as well. This issue is not yet resolved. Users are advised to add their own filtering or to reach out to the developer to aid in developing a patch.

Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. When using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The default report is based on the general-template.md template.The contents of the files are read and used to generate the report. However, the file contents are not properly filtered, leading to XSS. This may lead to commands executed on the host as well. This issue is not yet resolved. Users are advised to add their own filtering or to reach out to the developer to aid in developing a patch.

Summary

XSS occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server.

Details

When using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The default report is based on the general-template.md template.

<p align="center">
  <a href="https://www.osmedeus.org"><img alt="Osmedeus" src="https://raw.githubusercontent.com/osmedeus/assets/main/logo-transparent.png" height="140" /></a>
  <br />
  <br />
  <strong>Execute Summary Generated by Osmedeus {{Version}} at <em>{{CurrentDay}}</em></strong>

  <p align="center">
  <a href="https://docs.osmedeus.org/"><img src="https://img.shields.io/badge/Documentation-0078D4?style=for-the-badge&logo=GitBook&logoColor=39ff14&labelColor=black&color=black"></a>
  <a href="https://docs.osmedeus.org/donation/"><img src="https://img.shields.io/badge/Donation-0078D4?style=for-the-badge&logo=GitHub-Sponsors&logoColor=39ff14&labelColor=black&color=black"></a>
  <a href="https://twitter.com/OsmedeusEngine"><img src="https://img.shields.io/badge/%40OsmedeusEngine-0078D4?style=for-the-badge&logo=Twitter&logoColor=39ff14&labelColor=black&color=black"></a>
  </p>
</p>

## Scan Information 

<scanInfo />

***

## 🚀 Subdomains

<content src="{{Output}}/subdomain/final-{{Workspace}}.txt" shorten=true />

***

## 🌐 HTTP Fingerprint

<content src="{{Output}}/fingerprint/beautify-{{Workspace}}-http.txt" />

***

## 🐞 Vulnerability

### List of Vulnerability Reports

- [**{{Workspace}}-report.html**]({{Output}}/vuln/active/{{Workspace}}-report.html)
- [**{{Workspace}}-sensitive.html**]({{Output}}/vuln/sensitive/{{Workspace}}-sensitive.html)
- [**{{Workspace}}-nuclei.html**]({{Output}}/vuln/nuclei/{{Workspace}}-nuclei.html)

### Jaeles Scan

<content src="{{Output}}/vuln/active/jaeles-summary.txt" />

<content src="{{Output}}/vuln/sensitive/jaeles-summary.txt" />

***

### Nuclei Scan

<content src="{{Output}}/vuln/nuclei/{{Workspace}}-nuclei-scan.txt" />

***

## 🕷️ Spider Content

<content src="{{Output}}/linkfinding/links-{{Workspace}}.txt"/>

***

## 📃 Content Discovery

<content src="{{Output}}/directory/unique-beautify-{{Workspace}}.txt" />

***


## 🔍 Port Scan

<content src="{{Output}}/portscan/open-ports.txt" />


***

The contents of the files are read and used to generate the report. However, the file contents are not properly filtered, leading to XSS The issue starts with processing the <content> tags, and XSS occurs when the extendTag function is called.

https://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L36 https://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L95 https://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L114 https://github.com/j3ssie/osmedeus/blob/815c261d44f6df1183d77b0b264060eec3168f00/core/markdown.go#L122-L124

The condition to enter this if branch must meet one of the following cases:

• Tag shorten=true: In the default template, only subdomains have this tag ⇒ Subdomains cannot contain special characters, so XSS is not possible.
• len(fileContent) > r.Opt.MDCodeBlockLimit: Simply put, the content length needs to exceed the MDCodeBlockLimit configuration (default is 10,000).

After reviewing the files loaded in the default template, we select Spider Content because it meets the conditions:

• It can contain special characters since the spider retrieves results through Katana ⇒ Katana parses content based on <a> tags ⇒ We can create custom payloads by leveraging this mechanism."

 <! -- Fake Index Content --> 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Directory listing for /</title>
</head>
<body>
<h1>Directory listing for /</h1>
<hr>
<ul>
<li><a…

Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE in github.com/j3ssie/osmedeus

These are all security issues fixed in the govulncheck-vulndb-0.0.20241106T172143-1.1 package on the GA media of openSUSE Tumbleweed.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20241112T145010 2024-11-12T14:50:10Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3250 CVE-2024-51744 GHSA-29wx-vh33-7x7r

• Update to version 0.0.20241108T172500 2024-11-08T17:25:00Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3260 CVE-2024-45794 GHSA-q78v-cv36-8fxj
  • GO-2024-3262 CVE-2024-10975 GHSA-2w5v-x29g-jw7j

• Update to version 0.0.20241106T172143 2024-11-06T17:21:43Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3251 CVE-2024-10389 GHSA-q3rp-vvm7-j8jg
  • GO-2024-3252 CVE-2024-51746 GHSA-8pmp-678w-c8xx
  • GO-2024-3253 CVE-2024-48057 GHSA-ghx4-cgxw-7h9p
  • GO-2024-3254 CVE-2024-51735 GHSA-wvv7-wm5v-w2gv