Zimbra Collaboration - Cross-Site Scripting (XSS) Detection

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""An issue was discovered in Zimbra Collaboration (ZCS) 9."""

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Scanner, Http_client):
    __info__ = {
        'name': 'Zimbra Collaboration - Cross-Site Scripting (XSS) Detection',
        'description': 'An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload.',
        'author': ['KittySploit Team'],
        'severity': 'medium',
        'tags': ['web', 'scanner', 'cve', 'cve2024', 'zimbra', 'kev', 'passive', 'xss', 'vkev'],
        'agent': {
            'risk': 'active',
            'effects': ['network_probe'],
            'expected_requests': 1,
            'reversible': True,
            'approval_required': False,
            'produces': ['tech_hints', 'risk_signals', 'endpoints'],
            'cost': 1.0,
            'noise': 0.3,
            'value': 1.0,
            'requires': {
                'min_endpoints': 0,
                'min_params': 0,
                'tech_hints_any': [],
                'tech_hints_all': [],
                'specializations_any': [],
                'risk_signals_any': [],
                'auth_session': False,
                'capabilities_any': [],
                'capabilities_all': [],
                'confidence_min': {},
                'confidence_min_any': {},
                'endpoint_pattern_any': [],
                'param_any': [],
                'api_surface_ready': False,
            },
            'chain': {
                'produces_capabilities': [
                    {
                        'capability': 'admin_surface',
                        'from_detail': '',
                    },
                ],
                'consumes_capabilities': [],
                'option_bindings': {},
                'suggested_followups': [],
            },
        },
        'references': [
            'https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes',
            'https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes',
            'https://nvd.nist.gov/vuln/detail/CVE-2024-27443',
        ],
        'cve': 'CVE-2024-27443',
    }

    def run(self):
        path = '/js/zimbraMail/share/model/ZmSettings.js'
        r = self.http_request(method='GET', path=path, allow_redirects=False)
        if not r or r.status_code != 200:
            return False
        body = r.text or ""
        content_type = r.headers.get("Content-Type") or r.headers.get("content-type") or ""
        body_any = ('Zimbra Collaboration',)
        ctype_any = ('application/x-javascript',)
        if (any(m in body for m in body_any)) and (any(m in content_type for m in ctype_any)):
            self.set_info(
                severity='medium',
                reason='Zimbra Collaboration - Cross-Site Scripting (XSS) detected',
                path=path,
            )
            return True
        return False