Exploit Netwin SurgeFTP Sever 23d6 - Persistent Cross-Site Scripting

[Exploiter]

EDB-ID

38762

Проверка EDB

1. Пройдено

Автор

UN_N0N

Тип уязвимости

WEBAPPS

Платформа

WINDOWS

CVE

null

Дата публикации

2015-11-19

Netwin SurgeFTP Sever 23d6 - Persistent Cross-Site Scripting

********************************************************************************************
# Exploit Netwin SurgeFTP Sever Stored Cross Site Scripting Vulnerabilities 
# Date: 11/18/2015
# Exploit Author: Un_N0n
# Vendor: NetWin
# Software Link: http://netwinsite.com/cgi-bin/keycgi.exe?cmd=download&product=surgeftp
# Version: 23d6
# Tested on: Windows 7 x64(64bit)
********************************************************************************************
[Info]

Surgeftp web-interface suffers with multiple Stored XSS vulnerabilities.

They are:

Stored XSS in 'Domain Name' field.

[How to?]
1. Open SurgeFTP web interface, Click on global option from the menu.
2. Add a new domain, in 'Domain Name' field, add in this(<img src=x onmouseover=alert(1)>) payload.
3. Save, then navigate to main page, hover mouse over 'broken image' in 'domains' section.

Stored XSS in 'Mirrors'.

[How to?]
1. Open surgeftp web interface, Click on 'Mirrors' option from the menu.
2. Click on Add Mirror, in 'Local path' & 'Remote Host' field add in this(<img src=x onmouseover=alert(1)>) payload.
3. Save, then navigate to 'Mirror' page again, Hover mouse over the 'broken image' in 'local path' & 'remote host' field.

Previously, Somebody else reported Stored XSS vulnerabilities in SurgeFTP.
Vendor tried to fix the previously reported XSS vulnerabilities by blacklisting only the <script>alert('blah')</script> payload
which is well not a good practice since i have triggered the same vulnerability by just entering different XSS payload,
therefore White-listing is the correct solution.