Reflected XSS via user Parameter in /ssl-vpn/getconfig.esp

How it was found

Description: A reflected Cross-Site Scripting (XSS) vulnerability was discovered in the user parameter of the endpoint /ssl-vpn/getconfig.esp on █████. This allows an attacker to inject and execute arbitrary JavaScript in a user’s browser by tricking them into clicking a specially crafted URL.

Given that this is on a .mil domain and part of a VPN configuration system, the exploitability is heightened due to user trust and the sensitive nature of VPN portals.

Proof-of-Concept (PoC) URL:

███████&enc-algo=aes-128-cbc%2Caes-256-cbc&authcookie=12cea70227d3aafbf25082fac1b6f51d&portal=us-vpn-gw-N&user=%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cscript%3Eprompt(%22XSS%22)%3C%2Fscript%3E%3C%2Fsvg%3E&domain=%28empty_domain%29&computer=computer

Impact

• Allows JavaScript injection in the victim’s browser.

• Can be used for phishing, session hijacking, or impersonating the secure VPN login interface.

• Exploitable via social engineering (malicious links in emails or messages).

• Especially critical on a .mil domain where trust is high.

System Host(s)

█████████

Affected Product(s) and Version(s)

Fortinet FortiGate SSL VPN Web Portal, version 3.0.1-10 (as referenced in URL parameter app-version)

CVE Numbers

Steps to Reproduce

1. Navigate to the above PoC URL in any modern browser.

2. Observe a JavaScript prompt("XSS") popup.

3. This confirms successful execution of attacker-supplied script code via a reflected vector in the user parameter.

Suggested Mitigation/Remediation Actions

• Apply output encoding to all reflected parameters.

• Use input validation to reject or sanitize input containing <, >, ", ', and &.

• Implement Content Security Policy (CSP) headers to reduce exploitability.

• Conduct a broader audit of all getconfig.esp endpoints across .mil domains.