GeoVision Geowebserver 5.3.3 - Cross-Site Scripting

What is "GeoVision Geowebserver 5.3.3 - Cross-Site Scripting?"

The "GeoVision Geowebserver 5.3.3 - Cross-Site Scripting" module is designed to detect vulnerabilities related to cross-site scripting (XSS) in the GeoVision Geowebserver software. GeoVision Geowebserver is a web server software used for geospatial data management and visualization. This module focuses on version 5.3.3 and prior versions of the software.

The severity of this vulnerability is classified as high, indicating the potential for significant impact if exploited. The module was authored by madrobot.

Impact

If successfully exploited, the cross-site scripting vulnerability in GeoVision Geowebserver 5.3.3 could allow an attacker to inject malicious scripts into web pages viewed by users. This can lead to various consequences, such as unauthorized access to sensitive information, session hijacking, or the execution of arbitrary code.

How the module works?

The module works by sending a specific HTTP request to the target GeoVision Geowebserver. It checks for the presence of certain patterns in the response to determine if the vulnerability exists.

Here is an example of an HTTP request used by the module:

GET /Visitor/bin/WebStrings.srf?file=&obj_name=</script><script>alert(document.domain)</script> HTTP/1.1
Host: {%Hostname%}
Accept: */*

The module then applies several matching conditions to the response to confirm the presence of the vulnerability:

- The response body must contain the pattern "</script><script>alert(document.domain)</script>" - The HTTP status code must be 200 - The response header must include the word "text/html"

If all of these conditions are met, the module reports the vulnerability.