GestioIP 3.5.7 – Cross-Site Scripting (XSS)
# Exploit Title: GestioIP 3.5.7 - GestioIP Vulnerability: Auth. Cross-Site Scripting (XSS) # Exploit Author: m4xth0r (Maximiliano Belino) # Author website: https://maxibelino.github.io/ # Author email (max.cybersecurity at belino.com) # GitHub disclosure link: https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50857 # Date: 2025-01-13 # Vendor Homepage: https://www.gestioip.net/ # Software Link: https://www.gestioip.net/en/download/ # Version: GestioIP v3.5.7 # Tested on: Kali Linux # CVE: CVE-2024-50857 ### Description The `"ip_do_job"` feature of GestioIP 3.5.7 is vulnerable to XSS, leading to data exfiltration and CSRF attacks. Two examples are described below. ### Prerequisites To successfully exploit the XSS vulnerability, the user must be part of a "User Group" that has the following three permissions: • Show backuped device configurations (read_device_config_perm) • Upload device configurations (write_device_config_perm) • Administrate CM (administrative_cm_perm) 1) vulnerable parameter: `host_id` http://localhost/gestioip/res/cm/ip_do_job.cgi?client_id=1&host_id='<script>alert("test")</script>' 2) vulnerable parameter: `stored_config` http://localhost/gestioip/res/cm/ip_do_job.cgi?client_id=1&stored_config='<script>alert("test")</script>' |