Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected)

Author: Akıner Kısa
type: webapps
platform: multiple
port: 
date_added: 2021-09-22 
date_updated: 2021-09-22 
verified: 0 
codes: CVE-2021-40868 
tags: 
aliases:  
screenshot_url:  
application_url: 

# Exploit Title: Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected)
# Date: 10.06.2021
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://cloudron.io
# Software Link: https://www.cloudron.io/get.html
# Version: 6.3 >
# CVE : CVE-2021-40868


Proof of Concept:

1. Go to https://localhost/login.html?returnTo=
2. Type your payload after returnTo=
3. Fill in the login information and press the sign in button.