Summary

A file upload vulnerability exists in the LinkAce web application (v1.15.5). This issue occurs in the "Import Bookmarks" functionality, where malicious HTML files can be uploaded containing JavaScript payloads. These payloads execute when the uploaded links are accessed, leading to potential reflected or persistent XSS scenarios.

Details

The vulnerability arises because the application does not properly validate or sanitize the content of uploaded HTML files. An attacker can embed JavaScript payloads into the bookmarks file, which are reflected back and executed in the victim’s browser.

PoC

Detailed POC is attached for your perusal.

LinkAce_FileUpload_XSS_Report.pdf

Attacker can embed JavaScript payloads into the bookmarks file, which are reflected back and executed in the victim’s browser.

1. Create an HTML file (payload.html) with the content shown above.
2. Navigate to the "Import Bookmarks" page in LinkAce.
3. Upload the malicious HTML file.
4. Access the uploaded bookmarks link in the "All Links" section.
5. Observe the execution of the JavaScript payload, such as cookie theft or arbitrary JavaScript execution.
   Example of malicious HTML file content:

<!DOCTYPE NETSCAPE-Bookmark-file-1>
<!-- This is an automatically generated file.
     It will be read and overwritten.
     DO NOT EDIT! -->
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8">
<TITLE>Bookmarks</TITLE>
<H1>Bookmarks</H1>
<DL><p>
    <DT><H3 ADD_DATE="1693937296" LAST_MODIFIED="1735062757" PERSONAL_TOOLBAR_FOLDER="true">Bookmarks bar</H3>
    <DL><p>
        <!-- Payload 1: Simple XSS -->
        <DT><A HREF="javascript:alert('XSS 1 - Document Cookie: ' + document.cookie);" ADD_DATE="1735062736">Simple XSS Alert</A>
        
    </DL><p>
</DL><p>

Impact

This vulnerability allows attackers to:

Execute arbitrary JavaScript in the victim’s browser.
Steal session cookies and impersonate users.