# Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE

Reflected XSS in Saltcorn's edit-codepage name parameter chains with shell injection in the backup password to achieve 1-click RCE as admin.

- Payout: Research
- Severity: critical
- Program: Saltcorn
- Found by: Mathis-Z
- Disclosed: 2026-01-26
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-cr3w-cw5w-h3fj
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-cr3w-cw5w-h3fj
- Tags: area:web domain:web impact:ato impact:integrity impact:rce kind:research platform:ghsa sev:critical tech:nodejs technique:chained vuln:command-injection vuln:rce vuln:xss

**Target:** GET /admin/edit-codepage/:name and GET /admin/backup routes in @saltcorn/server
**Root cause:** The :name path parameter is inserted unsanitized into page breadcrumbs (reflected XSS), and the admin-supplied backup password is interpolated directly into the shell command building the backup zip (command injection).
**Steps:**
1. Confirm Saltcorn running at localhost:3000 with an active admin session.
2. Trigger XSS: `http://localhost:3000/admin/edit-codepage/%3Cimg%20src%3Dx%20onerror%3Dalert%281%29%3E%0A`
3. Trigger command injection: in backup section set admin password to `";$(whoami);"` (with quotes), then click 'Download a backup' under Manual backup.
4. Observe error page showing /bin/sh could not find binary named 'root' or 'saltcorn', confirming command execution.
5. Chain: craft malicious link that uses the XSS to drive the backup request with injected password, yielding RCE when an admin clicks it.
**How found:** Source review of admin routes: noticed the :name parameter rendered into breadcrumbs without sanitization, and the backup password concatenated into the shell command in backup.ts.
**Exploitation:** Attacker crafts a link to /admin/edit-codepage/<img onerror=...> that executes JS in the admin's session; the JS issues the backup request with a password containing `";$(cmd);"`, causing the server to run an arbitrary shell command. Requires admin to click the link (or iframe on attacker page) with an active session.
**Escalation:** XSS in admin context is chained into the authenticated backup endpoint to convert client-side script execution into server-side command execution (1-click RCE).
**Insight:** Admin-only endpoints that shell out (backup/export/zip) are prime injection sinks; a low-severity reflected XSS in the same admin surface can be chained to reach them, turning self-XSS into server RCE.

## Proof of concept (copied exactly from the original report)

**Reflected XSS URL in edit-codepage name parameter**

```
http://localhost:3000/admin/edit-codepage/%3Cimg%20src%3Dx%20onerror%3Dalert%281%29%3E%0A
```

**Command injection payload in backup password**

```
set an admin password like `";$(whoami);"` (including the quotation marks) and then click "Download a backup" in the "Manual backup" section.
```