Cross site scripting on Calico Labs

After running some subdomain enumeration scan on the domain calicolabs.com ,I found a Calico Research subdomain https://wi38.research.calicolabs.com/ . The application has Genome Browser functionality in which there is no validation of user input and an attacker can provide malicious HTML and javascript input in set track name paramter. The user can then create a permalink url with the saved malicious javascript and share it with other users to execute payload on their browser.

Steps to reproduce

1 . Access the set track name feature under genome browser.

Step 1

2 . Provide malicious javascript to alert domain name as input.

Step 2

3 . The javascript will execute as we can see the domain name popup.

Step 3

4 . By using create permalink functionality attacker can copy the URL with javascript saved on the current page and share it with other.

Step 4

5 . By accessing the copied URL on another browser we can confirm the javascript will be executed successfully on other users’ browser.

Step 5

TIMELINE