# Exploit Title:  eramba Enterprise & Community Editions Stored XSS
# Author:       Yunus YILDIRIM (Th3GundY)
# Team:         CT-Zer0 (@CRYPTTECH) - https://www.crypttech.com
# Website:         www.yunus.ninja
# Contact:       yunusyildirim@protonmail.com

 
1. ADVISORY INFORMATION
=======================
Product:        eramba Open-Source IT GRC 
Description:    eramba is a web-application that helps with the analysis, management and reporting of Security, 
        Governance, Risk and Compliance challenges.
        Founded in 2011 and followed by a community of tens of thousands, we are building the leading
        open-source GRC application on Internet.
Vendor URL:     http://www.eramba.org
Download Link:  http://www.eramba.org/resources/download/
 

2. VULNERABILITY SUMMARY
========================

Stored XSS in Notification Page.
eramba is vulnerable to a stored XSS when an user created Notifications with an
malicious payload on the "Notification Name" field.
The html/javascript payload is executed when another user tries to use the
see Notifications.



3. TECHNICAL DETAILS
========================
 
Stored XSS in Notification Page.
eramba is vulnerable to a stored XSS when an user created Notifications with an
malicious payload on the "Notification Name" field.
The html/javascript payload is executed when another user tries to use the
see Notifications.


4. PROOF OF CONCEPT
========================

PoC for Enterprise or Community Edition:
1- Go, System - Settings - Notifications menu or 
  Just go http://<eramba-IP>/notificationSystem/attach/Project
2- Click Manage button
3- Add Warning or Add Awareness or Add Default. You can select anyone of them.
4- In "Notification Name" field, here is the payload "><svg/onload=prompt(/CT-Zer0/)> 
5- Save it, you see pop-up
/notificationSystem/index/Project

PoC Video: https://www.youtube.com/watch?v=03xNMcpXqTs
 

5. AFFECTED VERSIONS
====================
Community Edition <= c1.0.6.001
Enterprise Edition <= e1.0.6.018


Vulnerability Disclosure Timeline:
=========================
29/11/2016   -   Contact With Vendor
30/11/2016   -   Vendor Response
14/12/2016   -   Public Dislosure