Jedox 2020.2.5 Exploit, Stored Cross-Site Scripting in Log-Module

# Exploit Title: Jedox 2020.2.5 - Stored Cross-Site Scripting in Log-Module
# Date: 28/04/2023
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL
# Vendor Homepage:
# Version: Jedox 2020.2 (20.2.5) and older
# CVE : CVE-2022-47877

A Stored cross-site scripting vulnerability allows remote authenticated users to inject arbitrary web scripts or HTML in the logs page via the log module. To exploit the vulnerability, the attacker must append an XSS payload to the log message.

See [Docs Syslifters]( for a detailed write-up on how to exploit vulnerability.

Proof of Concept
1) Store log entry with XSS payload:

	PATH: /ub/ccmd
			"<img src=# onerror=\"alert('XSS')\">"

2) Trigger XSS payload by opening the Logs page and showing the respective log entry.

All rights reserved 2009 - 2024
Powered by: MVCP2 / BVCP / ASPF-MILTER / PHP 8.3 / NGINX / FreeBSD