Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.
Locate the executor management function:
https://github.com/xuxueli/xxl-job/blob/289f02185b952f4652a4a7daf4ac3c6384f338bc/xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobGroupController.java
insert POC there has front-end validation,By code audit, I find that the back end only has length validation.Can be bypassed by Burp Intercept.
POC:<img/src=# onerror="alert(1)"/>
![image](https://user-images.githubusercontent.com/11627654/88906630-3e412d00-d28a-11ea-8240-a1c4b679a453.png)
The code directly gets AppName and manually entered parameters for front-end display.No filtering or encoding .Causes storage XSS vulnerabilities.
![image](https://user-images.githubusercontent.com/11627654/88906662-47ca9500-d28a-11ea-87a9-4fa0f9dd46a5.png)
The page automatically loads and triggers XSS every 60 seconds.
![image](https://user-images.githubusercontent.com/11627654/88906721-5b75fb80-d28a-11ea-81ce-485883386edd.png)
![image](https://user-images.githubusercontent.com/11627654/88906736-5f098280-d28a-11ea-975a-3076f861f116.png)
v2.2.0 Stored XSS vulnerabilities
This is a GitHub Issue
repo:xxl-job
owner:xuxueli
Title : v2.2.0 Stored XSS vulnerabilities
Issue date:

--- start body ---
Locate the executor management function:
https://github.com/xuxueli/xxl-job/blob/289f02185b952f4652a4a7daf4ac3c6384f338bc/xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobGroupController.java
insert POC there has front-end validation,By code audit, I find that the back end only has length validation.Can be bypassed by Burp Intercept.
POC:<img/src=# onerror="alert(1)"/>
![image](https://user-images.githubusercontent.com/11627654/88906630-3e412d00-d28a-11ea-8240-a1c4b679a453.png)
The code directly gets AppName and manually entered parameters for front-end display.No filtering or encoding .Causes storage XSS vulnerabilities.
![image](https://user-images.githubusercontent.com/11627654/88906662-47ca9500-d28a-11ea-87a9-4fa0f9dd46a5.png)
The page automatically loads and triggers XSS every 60 seconds.
![image](https://user-images.githubusercontent.com/11627654/88906721-5b75fb80-d28a-11ea-81ce-485883386edd.png)
![image](https://user-images.githubusercontent.com/11627654/88906736-5f098280-d28a-11ea-975a-3076f861f116.png)
--- end body ---

The issue describes a stored Cross-Site Scripting (XSS) vulnerability in the XXL-Job application, specifically in the JobGroupController. The vulnerability arises from insufficient input validation on the backend, which only checks the length of the input, allowing attackers to inject malicious scripts. The provided proof of concept (PoC) demonstrates how an attacker can insert an image tag with an onerror event that triggers an alert, indicating that the application does not properly sanitize user input before storing it. This can lead to the execution of arbitrary JavaScript in the context of the user's browser, potentially compromising user data and session information.