unilogies/bumsys < v2.0.2 - Clickjacking

mediumseverity

6.1CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

This template checks for the presence of clickjacking prevention headers in the HTTP response, aiming to identify vulnerabilities related to the improper restriction of rendered UI layers or frames in the GitHub repository unilogies/bumsys prior to version 2.0.2.

Impact

An attacker can trick users into performing unintended actions on the vulnerable application.

Fix

Upgrade to version 2.0.2 or later to mitigate the Clickjacking vulnerability.

How to confirm it

Send: GET {{BaseURL}}
Positive when: status_code_1 == 200 and !regex('X-Frame-Options', header) and contains(body, 'BUM</b>Sys</a>')

Run it with nuclei: nuclei -id CVE-2023-1362 -u <target>

The full check

id: CVE-2023-1362

info:
  name: unilogies/bumsys < v2.0.2 - Clickjacking
  author: ctflearner
  severity: medium
  description: |
    This template checks for the presence of clickjacking prevention headers in the HTTP response, aiming to identify vulnerabilities related to the improper restriction of rendered UI layers or frames in the GitHub repository unilogies/bumsys prior to version 2.0.2.
  impact: |
    An attacker can trick users into performing unintended actions on the vulnerable application.
  remediation: |
    Upgrade to version 2.0.2 or later to mitigate the Clickjacking vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1362
    - https://huntr.dev/bounties/e5959166-c8ef-4ada-9bb1-0ff5a9693bac/
    - https://github.com/unilogies/bumsys/commit/8c5b27d54707f9805b27ef26ad741f2801e30e1f
    - https://github.com/ctflearner/ctflearner
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-1362
    cwe-id: CWE-1021
    epss-score: 0.01411
    epss-percentile: 0.72903
    cpe: cpe:2.3:a:bumsys_project:bumsys:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: bumsys_project
    product: bumsys
  tags: cve,cve2023,bumsys,clickjacking,huntr,bumsys_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 200"
          - "!regex('X-Frame-Options', header)"
          - "contains(body, 'BUM</b>Sys</a>')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from