Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.
Locate the executor management function:
https://github.com/xuxueli/xxl-job/blob/289f02185b952f4652a4a7daf4ac3c6384f338bc/xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobGroupController.java
insert POC there has front-end validation,By code audit, I find that the back end only has length validation.Can be bypassed by Burp Intercept.
POC:<img/src=# onerror="alert(1)"/>
![image](https://user-images.githubusercontent.com/11627654/88906630-3e412d00-d28a-11ea-8240-a1c4b679a453.png)
The code directly gets AppName and manually entered parameters for front-end display.No filtering or encoding .Causes storage XSS vulnerabilities.
![image](https://user-images.githubusercontent.com/11627654/88906662-47ca9500-d28a-11ea-87a9-4fa0f9dd46a5.png)
The page automatically loads and triggers XSS every 60 seconds.
![image](https://user-images.githubusercontent.com/11627654/88906721-5b75fb80-d28a-11ea-81ce-485883386edd.png)
![image](https://user-images.githubusercontent.com/11627654/88906736-5f098280-d28a-11ea-975a-3076f861f116.png)
v2.2.0 Stored XSS vulnerabilities
This is a GitHub Issue
repo:xxl-job
owner:xuxueli
Title : v2.2.0 Stored XSS vulnerabilities
Issue date:

--- start body ---
Locate the executor management function:
https://github.com/xuxueli/xxl-job/blob/289f02185b952f4652a4a7daf4ac3c6384f338bc/xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobGroupController.java
insert POC there has front-end validation,By code audit, I find that the back end only has length validation.Can be bypassed by Burp Intercept.
POC:<img/src=# onerror="alert(1)"/>
![image](https://user-images.githubusercontent.com/11627654/88906630-3e412d00-d28a-11ea-8240-a1c4b679a453.png)
The code directly gets AppName and manually entered parameters for front-end display.No filtering or encoding .Causes storage XSS vulnerabilities.
![image](https://user-images.githubusercontent.com/11627654/88906662-47ca9500-d28a-11ea-87a9-4fa0f9dd46a5.png)
The page automatically loads and triggers XSS every 60 seconds.
![image](https://user-images.githubusercontent.com/11627654/88906721-5b75fb80-d28a-11ea-81ce-485883386edd.png)
![image](https://user-images.githubusercontent.com/11627654/88906736-5f098280-d28a-11ea-975a-3076f861f116.png)
--- end body ---
