POC详情： 00f83eff038d95beff3eb6f36882fd942d3220bf

来源
https://github.com/Security-AVS/CVE-2021-29267
关联漏洞
标题： sherlock SherlockIM 跨站脚本漏洞 (CVE-2021-29267)
描述：sherlock SherlockIM是美国sherlock公司的一个应用软件。用于在WhatsApp中管理与客户的各种对话。 Sherlock SherlockIM through 2021-03-29 存在跨站脚本漏洞，攻击者可利用api文件附件URI。
描述
SherlockIM ChatBot XSS
介绍
# CVE-2021-29267
SherlockIM ChatBot XSS

[Suggested description]: SherlockIM is vulnerable to Persistent XSS.

[Additional Information]: SherlockIM - Platform for manage all kind of conversations with customers.

[Vulnerability Type]: Cross Site Scripting (XSS)

[Vendor of Product]: https://sherlockim.ae

A letter was sent to the vendor about the vulnerability.

[Attack Type]: Remote

[Attack Vectors]: Attacker uploads malicious HTML file via chat bot. Malicious file is loaded in customer subdomain (every customer has unique subdomain in the sherlockcrm domain). Malicious code in uploaded file successfully executed in "customer.sherlockcrm.ru". Link to uploaded file leaks via chat bot and has the following format: https://customer.sherlockcrm.ru/api/Files/Attachment/unique_ID.html. Link is valid until manual delete. Attacker can attack help desk employees. 

[Discovered]: Alexander Semenenko

[Reference]: https://sherlockim.ae

[Proof of Concept]:

![alt text](https://github.com/Security-AVS/CVE-2021-29267/blob/main/Successful%20execution%20of%20code.png)
文件快照

 [4.0K]  /data/pocs/00f83eff038d95beff3eb6f36882fd942d3220bf
├── [1.0K]  README.md
└── [ 79K]  Successful execution of code.png

0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。