kiteworks by Accellion - Reflected XSS

Published
Credit
Risk
2017.07.11
bRpsd
Low
CWE
CVE
Local
Remote
CWE-79
N/A
No
Yes

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Product -> kiteworks by Accellion - Reflected XSS
Date Found -> July 11, 2017
Author -> bRpsd
Contact via skype => vegnox
Kiteworks Website -> https://www.kiteworks.com/
Vendor Website -> http://www.accellion.com/solutions
Tested on -> ngix, on all current versions of kiteworks.
Shodan Dork -> https://www.shodan.io/search?query=Set-Cookie%3A+idpSAMLSessionID
Shodan Total Results -> 622
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@


#############
|DESCRIPTION|
#############
"Kiteworks Enables secure access and sharing of enterprise content from any device, including laptop, desktop or mobile. kiteworks enhances business productivity while ensuring data security and compliance.."




Vulnerability: Reflected Cross Site Scripting
File Path: http://target/idp/module.php/accellion/loginuserpass.php
Vul Parameter: code



Using a valid [AuthState] key which is normally generated by the server , you can reflect html using the [code] parameter.


Example :
http://172.1.2.3/idp/module.php/accellion/loginuserpass.php?AuthState=_b13beca9492737139e3ec622fc0306a520b3082948&code=</><h1>Reflected XSS here.




-


See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2017, cxsecurity.com