elmsln/haxcms

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.

Summary

The HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.

Details

The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation.

Affected Resources

• Operations.php: 760 createNode()
• Operations.php: 868 saveNode()
• Operations.php: 1171 deleteNode()
• Operations.php: 1789 listSites()
• Operations.php: 1890 createSite()
• Operations.php: 2196 getConfig()
• Operations.php: 2389 cloneSite()
• Operations.php: 2467 deleteSite()
• Operations.php: 2524 downloadSite()
• Operations.php: 2607 archiveSite()

Note: This may not include all affected endpoints within the application.

Impact

An authenticated attacker can make requests to interact with other users' sites. This can be used to enumerate, modify, and delete other users' sites and nodes.

Additionally, an authenticated attacker can use the 'getConfig' endpoint to pull the application's configuration, which may store cleartext credentials.

PoC - /deleteNode

1. Browse to the 'site.json' file for a target site, and note the ID of the item to delete.

2. Make a POST request to the 'deleteNode' endpoint with a valid JWT and the target object ID.

Site before editing:

Site after editing:

Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.

Summary

An authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).

Details

The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.

Later the location parameter is interpreted by the CMS like in HAXCMSSite.php line 1248 to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.

PoC

1. Authenticate to the CMS and retrieve the JWT and CSRF token.

2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :

3. Curl the website root to see the file contents.

Impact

This is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.

Summary

The application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site.

Although the application does not allow users to supply a 'script' tag, it does allow the use of other HTML tags to run JavaScript.

Affected Resources

• Operations.php:258 saveManifest()
• Operations.php:868 saveNode()
• https://<site>/<user>/system/api/saveNode
• https://<site>/<user>/system/api/saveManifest

Impact

An authenticated attacker can use the site editor and settings editor to store malicious payloads in a HAX site which execute arbitrary JavaScript when a user visits the site. This can be used to steal a user's session cookie or other sensitive data.

PoCs

saveNode

To replicate this vulnerability, an attacker can use the "View Source" functionality within the site editor to enter a malicious payload.

1. Select "View Source" within the HAX site editor and enter an XSS payload that does not use the "script" HTML tag.

3. Select "Update HTML" and observe the resulting alert.

saveManifest

To exploit the 'SaveManifest' endpoint, an attacker can insert executable code into the URL field of the site settings editor: any payload added this way will execute when the site is loaded.

1. Open the site settings editor.

3. Add JavaScript code to the URL field under the "Theme" header.

5. Reload the page to run the script.

7. The resulting page source will contain the script.