Reflected XSS via user parameter on getconfig.esp endpoint

How it was found

Description: The getconfig.esp endpoint reflects unsanitized user input provided in the user parameter directly into the HTML response. This results in a Reflected Cross-Site Scripting (XSS) vulnerability.

An attacker can trick a victim into clicking a crafted URL, resulting in arbitrary JavaScript execution in the context of the victim's browser. This can lead to cookie theft, session hijacking, phishing, or browser-based exploitation.

Proof of Concept (PoC):

█████████<svg xmlns="http://www.w3.org/2000/svg"><script>prompt("XSS")</script></svg>&domain=(empty_domain)&computer=computer

Impact

• Session Hijacking

• Phishing & Credential Theft

• Browser-based Exploitation

• Access to Internal VPN Resources (if session cookies are stolen)

System Host(s)

██████████

Affected Product(s) and Version(s)

Fortinet SSL VPN (FortiOS) — Version: 3.0.1-10 (as per app-version parameter)

CVE Numbers

Steps to Reproduce

1. Open the following URL in a browser (or simulate as a logged-in VPN user if authentication is needed):
2. Observe that the JavaScript payload is executed and a prompt box appears, confirming the XSS.

Suggested Mitigation/Remediation Actions

• Properly sanitize and encode all user-supplied input before reflecting it in responses.

• Apply input validation and enforce Content Security Policy (CSP).

• Consider upgrading to the latest patched version of Fortinet firmware addressing CVE-2025-0133.