# Exploit Title: Cross-Site-Scripting (XSS) (Reflected) in Ellevo application
# Google Dork: N/A
# Date: 22/01/2024
# Exploit Author: Thiago Miranda de Paula - dTMP3st
# LinkedIn Author: https://www.linkedin.com/in/dtmp3st/
# Vendor Homepage: https://ellevo.com/
# Software Link: N/A
# Version: 6.2.0.38160
# Tested on: Kali Linux / Burp Suite Professional / Firefox 115.13.0esr (64-bit)
# CVE : CVE-2024-46655

After testing, it was possible to conclude that the Ellevo service manager platform has a Cross-Site-Scripting (XSS) (Reflected) item. It occurs through an error handling call from the platform, where the User-Agent request header is rendered on the application’s Front-End. Understanding this, it is possible to use a Cross-Site-Scripting payload in the User-Agent header.

Steps to Reproduce:

  1. Find any entry point that handles errors by rendering information from the browser used in the front-end.
  2. Intercept an HTTP Request with some Web Proxy (in this case, I used Burp Suite Professional) and include a Cross-Site-Scripting (XSS) payload in the User-Agent header.
  3. Payload used (URL Encode): %3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%29%3c%2f%73%63%72%69%70%74%3e
  4. Using this example payload, when forwarding the request, the HTTP Response will return the session cookies.

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.

References

MITRE