FixVibe
Research notemedium

Stored XSS in osTicket Installation Script (CVE-2019-14750)

A stored cross-site scripting (XSS) vulnerability was identified in osTicket versions prior to 1.10.7 and 1.12.x before 1.12.1. The flaw exists in the setup/install.php script due to a lack of input sanitization in the firstname and lastname fields. Attackers can exploit this to inject malicious scripts that execute in the context of other users' browsers.

CVE-2019-14750CWE-79

Impact

An attacker can inject malicious JavaScript into the application's database via the installation setup script [S1]. When an administrator or another user views the stored data, the script executes in their browser session. This can lead to session hijacking, unauthorized actions on behalf of the user, or the theft of sensitive information [S1].

Root Cause

The vulnerability stems from insufficient input validation and sanitization in the setup/install.php file [S1]. Specifically, the firstname and lastname fields do not properly filter or encode user-supplied data before storing it in the system [S1]. This allows the insertion of HTML tags and JavaScript payloads that are later rendered by the application without escaping.

How FixVibe could detect it

FixVibe could detect this vulnerability through its repository scanning and active probing capabilities:

  • Repository Scanning: FixVibe's code analysis engine could scan for the presence of setup/install.php in osTicket installations and identify the lack of sanitization functions (like htmlspecialchars or equivalent) on the firstname and lastname parameters.
  • Active Probing: For live instances where the setup directory has not been removed, FixVibe could attempt to submit benign HTML markers to the setup/install.php endpoint and check if they are reflected without encoding in subsequent administrative views.

Remediation

To mitigate this vulnerability, users should:

  • Update osTicket: Upgrade to version 1.10.7, 1.12.1, or later, where input sanitization has been implemented for these fields [S1].
  • Remove Setup Directory: As a security best practice, always delete the setup/ directory immediately after completing the installation of osTicket to prevent unauthorized access to installation scripts.
Stored XSS in osTicket Installation Script (CVE-2019-14750) — FixVibe research · FixVibe