Vulnerability Report - Reflected XSS in configuracao_geral.php parameter msg

[nmmorette]

Vulnerability Description

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the WeGIA application, specifically on the home.php page. This flaw allows an attacker to inject malicious scripts into the browser's context, potentially leading to cookie theft, redirection to malicious websites, or unauthorized actions on behalf of the user.

Location

Vulnerable Endpoint: html/configuracao/configuracao_geral.php
Affected Parameter: msg
Exploit Payload: "><script>alert(document.cookie)</script>

Attack Description

When accessing the URL https://comfirewall.wegia.org:8000/WeGIA/html/home.php?msg_c=<script>alert(document.cookie);</script>,, the browser executes the injected script, displaying an alert containing the user's cookies. This demonstrates that the msg parameter is not properly sanitized, allowing arbitrary JavaScript code injection.

Vulnerability Impact: Exploiting this vulnerability successfully may result in:

Session Hijacking: An attacker can capture session cookies, granting unauthorized access to the user's account.
Phishing: Redirecting users to malicious websites mimicking legitimate pages to steal credentials.
Unauthorized Actions: Performing unwanted operations on behalf of the user without their consent.

POC

Recommendations

1. Input Sanitization: Implement proper sanitization of all user-provided data, especially parameters reflected on the page, to remove or encode special characters that can be interpreted as code.
2. Input Validation: Enforce strict validation on received parameters to ensure only expected data is processed.
3. Output Escaping: Ensure all dynamic data inserted into the HTML is properly escaped to prevent script execution.
4. Content Security Policy (CSP): Configure a Content Security Policy to restrict the execution of unauthorized scripts.

References

OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/XSS_Prevention_Cheat_Sheet.html
OWASP Content Security Policy Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html