A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Piranha CMS v12.1. The issue exists in the comment system where the AuthorUrl and CommentUrl fields are not properly sanitized or encoded before being rendered in the Razor views. This allows an unauthenticated remote attacker to inject malicious JavaScript payloads.
Vulnerability Type: Stored XSS
Affected Version: v12.1 (and possibly earlier)
Component: Comment Module / Razor Views (.cshtml)
Steps to Reproduce (PoC):
Navigate to any post/page with comments enabled.
Submit a new comment.
In the "Website" or "URL" field, input the following payload: javascript:alert(document.cookie)
Once the comment is rendered (auto-approved in default config), any user who clicks on the author's name/link will execute the script.
Impact:
Session Hijacking via cookie theft.
Potential administrative account takeover if an admin interacts with the malicious link.
Technical Analysis:
The vulnerability occurs because the CommentUrl is directly placed within the href attribute of an tag without context-aware encoding.
Reference:https://substack.com/home/post/p-188991840?source=queue
Proposed Fix:
Use Url.Content() or a proper HTML sanitizer to validate the URL schema (allow only http and https) and ensure the output is correctly encoded for the attribute context.
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Piranha CMS v12.1. The issue exists in the comment system where the AuthorUrl and CommentUrl fields are not properly sanitized or encoded before being rendered in the Razor views. This allows an unauthenticated remote attacker to inject malicious JavaScript payloads.
Vulnerability Type: Stored XSS
Affected Version: v12.1 (and possibly earlier)
Component: Comment Module / Razor Views (.cshtml)
Steps to Reproduce (PoC):
Navigate to any post/page with comments enabled.
Submit a new comment.
In the "Website" or "URL" field, input the following payload: javascript:alert(document.cookie)
Once the comment is rendered (auto-approved in default config), any user who clicks on the author's name/link will execute the script.
Impact:
Session Hijacking via cookie theft.
Potential administrative account takeover if an admin interacts with the malicious link.
Technical Analysis:
The vulnerability occurs because the CommentUrl is directly placed within the href attribute of an tag without context-aware encoding.
Reference:https://substack.com/home/post/p-188991840?source=queue
Proposed Fix:
Use Url.Content() or a proper HTML sanitizer to validate the URL schema (allow only http and https) and ensure the output is correctly encoded for the attribute context.