# YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

Unauthenticated User-Agent header persisted to YAFNET EventLog via a forced exception, then rendered unencoded in admin Event Log page, executing XSS in admin session.

- Payout: Research
- Severity: high
- Program: YAFNET
- Found by: MuhammadUwais
- Disclosed: 2026-05-05
- CVE: CVE-2026-43938
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-33gv-fc78-qgf5
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-33gv-fc78-qgf5
- Tags: area:web domain:web impact:ato impact:privesc kind:research platform:ghsa sev:high tech:dotnet tech:rest technique:second-order vuln:info-disclosure vuln:xss

**Target:** ASP.NET forum app: DbLogger, /api/Attachments/GetAttachment, /Admin/EventLog
**Root cause:** DbLogger serializes the attacker-controlled User-Agent into EventLog.Description JSON; FormatStackTrace() interpolates the UserAgent value into an HTML string without encoding and the Razor view emits it via @Html.Raw.
**Steps:**
1. Send unauthenticated request with malicious UA: `curl.exe -sS -A "<img src=x onerror=alert('XSS')>" "http://yetanotherforum.internal:8080/api/Attachments/GetAttachment?attachmentId=2147483647"`
2. Confirm error response and a new dbo.EventLog row whose JSON Description contains the attacker UserAgent
3. As admin (Superuser) visit `/Admin/EventLog`
4. Observe raw `<img src=x onerror="alert('XSS')">` rendered in the event badge block and onerror firing in admin session
**How found:** Traced attacker-controlled input (User-Agent header) through DbLogger persistence into EventLog.Description, then followed the admin EventLog rendering path to FormatStackTrace() and @Html.Raw, spotting the missing output encoding at the second-order sink.
**Exploitation:** Single anonymous HTTP request to a public endpoint forces a server-side exception that logs the attacker-controlled User-Agent; when an admin later opens the Event Log, the payload executes in their authenticated origin, allowing admin actions like creating admin accounts, changing site settings, or exfiltrating data via admin-only endpoints.
**Escalation:** XSS in admin origin escalates from anonymous request to full forum takeover by abusing the admin's session privileges.
**Insight:** Look for second-order sinks where request metadata (User-Agent, Referer, X-Forwarded-For) is JSON-serialized into a log/DB and later deserialized and rendered with Html.Raw in an admin UI; force exceptions on unauthenticated endpoints to plant log entries.

## Proof of concept (copied exactly from the original report)

**Unauthenticated curl request with XSS User-Agent payload**

```
curl.exe -sS -A "<img src=x onerror=alert('XSS')>" "http://yetanotherforum.internal:8080/api/Attachments/GetAttachment?attachmentId=2147483647"`
```