Description
BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascript: URLs in the admin operation log via the X-Rewrite-URL header. When an administrator clicks the log entry's url open button, the script runs in the backend origin and steals the adminInfo token from localStorage, enabling account takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| build-admin | buildadmin | 1.0.1 ≤2.3.9 | — |
References
- https://github.com/build-admin/BuildAdmin/issues/70
- https://vul.yulun.ac.cn/20261112/buildadmin/
- https://github.com/build-admin/BuildAdmin/blob/v2.3.9/app/admin/model/AdminLog.php#L145-L153
- https://github.com/build-admin/BuildAdmin/blob/v2.3.9/web/src/components/table/fieldRender/url.vue#L32-L38
- https://www.vulncheck.com/advisories/buildadmin-1.0.1-through-2.3.9-stored-xss-via-x-rewrite-url-in-admin-log