# Exploit Title: Stored Cross-Site Scripting (XSS) in ARIS: Business
\nProcess Management
\n# Edition Version 10.0.21.0
\n# Exploit Author: Seid Yassin
\n# Date: 2024-03-28
\n# Vendor: Software AG
\n# Software Link: https:\/\/aris.com\/
\n# Version: ARIS: Business Process Management<\/p>\n
## Description:<\/p>\n
Discovered a file upload feature lacking proper file extension validation.
\nThis vulnerability allows attackers to upload any type of file, including
\nmalicious ones. To demonstrate this, we successfully uploaded an SVG file
\nto carry out a Cross-Site Scripting (XSS) attack. In XSS attacks, malicious
\nscripts are injected into web pages viewed by other users, potentially
\nleading to data theft or unauthorized actions leading to potential theft of
\ncookies and session tokens.<\/p>\n
## Background:<\/p>\n
Cross-site scripting (XSS) is a common web security vulnerability that
\ncompromises user interactions with a vulnerable application. Stored XSS
\noccurs when user input is stored in the application and executed whenever a
\nuser triggers or visits the page.<\/p>\n
## Issue:<\/p>\n
A stored cross-site scripting (XSS) vulnerability in ARIS: Business Process
\nManagement software enables a malicious authenticated user to store a xss
\npayload(via SVG) using the web interface. Then, when viewed by a properly
\nauthenticated user or administrator, the JavaScript payload executes within
\nSVG and disguises all associated actions as performed by that unsuspecting
\nauthenticated user\/administrator.<\/p>\n
## Steps To Reproduce:<\/p>\n
1. Log into the ARIS application.
\n2. Navigate to my tasks and select any of the task and upload documents
\n(change request form)
\n3. Insert any svg file with xss script in it . eg.
\nhttps:\/\/gist.github.com\/rudSarkar\/76f1ce7a65c356a5cd71d058ab76a344<\/p>\n
## Expected Result:<\/p>\n
After a user uploads a new document in the Change Request Form, they can
\nutilize the link for the SVG file and UUID to access another path at
\n{{url}}\/documents\/api\/documents\/{{UUID}}\/content<\/p>\n
## Actual Result:<\/p>\n
The ARIS application is vulnerable to Stored Cross-Site Scripting, as
\nevidenced by the successful execution of the injected payload.<\/p>\n
## Proof of Concept:<\/p>\n
Attached Screenshots for the reference.<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Stored Cross-Site Scripting (XSS) in ARIS: Business Process Management # Edition Version 10.0.21.0 # Exploit Author: Seid Yassin # Date: 2024-03-28 # Vendor: Software AG # Software Link: https:\/\/aris.com\/ # Version: ARIS: Business Process Management ## Description: Discovered a file upload feature lacking proper file extension validation. This vulnerability allows attackers to …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-55761","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/55761","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=55761"}],"version-history":[{"count":1,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/55761\/revisions"}],"predecessor-version":[{"id":55774,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/55761\/revisions\/55774"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=55761"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=55761"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=55761"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}