Stored XSS in Open Source Social Network (OSSN) via Users Timeline

Open Source Social Network (OSSN) version 6.3 LTS contains a stored cross-site scripting (XSS) vulnerability, tracked as CVE-2022-34961. The vulnerability exists within the 'Users Timeline' module, where the application fails to properly sanitize user-supplied input in the location field. An authenticated attacker can inject arbitrary JavaScript payloads into this field, which is subsequently stored by the server. When an unsuspecting user, such as an administrator or another user, views the affected timeline post, the browser executes the injected script in the context of the user's session. This could lead to unauthorized actions, session hijacking, or credential harvesting. Given the availability of a public proof-of-concept exploit, environments running OSSN 6.3 should be considered at risk.

Attack Chain

1. The attacker creates an account on the target Open Source Social Network instance or logs into an existing account.
2. The attacker navigates to the 'Users Timeline' section by selecting the profile/username.
3. The attacker initiates a new post by interacting with the data entry form.
4. The attacker triggers the location input field within the wall post component.
5. The attacker submits a crafted XSS payload (e.g., <script>alert(1)</script>) into the location parameter via a POST request to /ossn/action/wall/post/u.
6. The application stores the malicious payload in the backend database.
7. A victim user visits the attacker's timeline or a feed where the malicious post is displayed.
8. The victim's browser renders the stored payload, executing the JavaScript in the victim's session context.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the victim's browser. Potential impacts include session hijacking, redirection to malicious sites, and the performance of unauthorized actions on behalf of the victim, such as modifying account settings or exfiltrating private data. This vulnerability affects OSSN version 6.3 LTS.

Recommendation

1. Update to the latest stable version of Open Source Social Network to ensure all security patches are applied.
2. Implement a strict Content Security Policy (CSP) to mitigate the impact of stored XSS by restricting the execution of unauthorized scripts.
3. Validate and sanitize all user-supplied input at the application layer, specifically for the location field in the Users Timeline module.
4. Enable logging for HTTP POST requests to /ossn/action/wall/post/u and monitor for suspicious payloads containing script tags or event handlers (e.g., onload, onerror).