CVE-2019-13970

Vulnerability

Description

CVE-2019-13970 is a self-XSS vulnerability found in antSword versions prior to 2.1.0. The flaw exists in multiple database configuration modules: modules/database/asp/index.js, modules/database/custom/index.js, modules/database/index.js, and modules/database/php/index.js. The root cause is insufficient sanitization of user-controlled input displayed in the user interface, which allows an attacker to inject malicious JavaScript code that executes in the context of the application's Electron-based GUI [1] [2].

Exploitation

Prerequisites

To exploit this vulnerability, an attacker must first gain the ability to inject crafted payloads into database configuration fields that are subsequently rendered without proper escaping. In the context of antSword, which is a cross-platform website administration tool commonly used by penetration testers, an attacker could trick a user (e.g., via social engineering) into importing a malicious configuration or entering crafted data during database setup. The fix commit shows that the antSword.noxss() function was applied to sanitize text values such as connection type labels, display names, and other user-controllable strings [2] [3].

Impact

Successful exploitation of this self-XSS can lead to arbitrary code execution within the Electron application's context. Since antSword runs with Node.js integration enabled in Electron, an attacker who executes JavaScript in this environment can gain full access to the underlying system—reading local files, executing shell commands, and interacting with the system as the current user. This elevates a client-side injection vulnerability into a severe remote code execution scenario when combined with Electron's capabilities [1] [2].

Mitigation

Users should upgrade to antSword version 2.1.0 or later, where the self-XSS has been addressed by properly escaping user-supplied data using the noxss helper function before rendering it in the UI. The fix was applied in commit 4b932e81447b4b0475f4fce45525547395c249d3 and merged with the release of version 2.1.0. No official workaround exists for installations that cannot be updated [2] [3].