Reflected XSS via user Parameter on getconfig.esp Endpoint

How it was found

Summary: An attacker can inject arbitrary JavaScript into the user parameter of the /ssl-vpn/getconfig.esp endpoint, leading to reflected Cross-Site Scripting (XSS). This allows remote attackers to execute malicious scripts in the victim's browser, potentially stealing session cookies, performing actions on behalf of the user, or redirecting them to malicious sites.

Impact

• An attacker can craft a malicious URL and trick victims (e.g., via phishing emails or malicious links) into visiting the site, leading to:

• Theft of session tokens (if stored in cookies).

• Execution of arbitrary actions in the user's context.

• Phishing attacks using fake login forms.

• Redirection to malicious domains.

System Host(s)

█████████

Affected Product(s) and Version(s)

DoD Morpheus SSL VPN Web Portal (Version unknown, observed in production as of June 2025)

CVE Numbers

Steps to Reproduce

• Open a browser (e.g., Chrome or Firefox).

• Paste the full PoC URL into the address bar.

• Press Enter.

• Observe a JavaScript prompt('XSS') triggered via the SVG/script payload.

Suggested Mitigation/Remediation Actions

Recommendation:

• Properly sanitize and encode user input before reflecting it back in the HTML response.

• Use a secure templating engine that automatically escapes output.

• Set a Content Security Policy (CSP) to mitigate inline script execution.

• Validate inputs on both client and server sides.