Description

Cross-Site Scripting vulnerability which allows attackers to execute arbitrary javascript code in the browser of a victim which affected import Data set feature via a spreadSheet file upload.

Proof of Concept

Endpoint

1 POST http://{HOST}/app/admin/import-export/import-vlan-preview.php

2 POST http://{HOST}/app/admin/import-export/import-subnets-preview.php

3 POST http://{HOST}/app/admin/import-export/import-vrf-preview.php

4 POST http://{HOST}/app/admin/import-export/import-ipaddr-preview.php

5 POST http://{HOST}/app/admin/import-export/import-devtype-preview.php

6 POST http://{HOST}/app/admin/import-export/import-devices-preview.php

7 POST http://{HOST}/app/admin/import-export/import-l2dom-preview.php

~

Affected parameter:

Noted** Basically all parameter in each endpoints

reqfields, filetype, importFields__name, importFields__number, importFields__description, importFields__domain etc

~

Payload:

/**/<script>alert(document.cookie)</script>

'><details/open/ontoggle=confirm(document.cookie)>

~

Steps to reproduce:

1 Login as admin.

2 Click Administration > Import/Export

3 Select data set appropriately

4 Click Import button and upload xls file containing XSS payloads with the correct template.

5 Click Preview button and XSS will triggered.

~

• PoC xls file containing XSS payloads
• PoC Burp Request
• PoC XSS triggered

~

List of xls file contain XSS payload:

• vlan XSS payloads
• subnet XSS payloads
• ipaddr XSS payloads
• vrf XSS payloads

Impact

This vulnerability is capable of deface websites, run malicious javascript code on web pages, stealing a user's cookie and gain unauthorized access to that user's account through the stolen cookie.