CVE-2021-35488

Vulnerability Description: Reflected Cross-Site Scripting - CWE-79
Software Version: <= 2.40-2
NIST: https://nvd.nist.gov/vuln/detail/CVE-2021-35488
CVSv3: 6.1
Severity: Medium
Credits: Mattia Campanelli, Alessandro Bosco, Alessandro Sabetta, Massimiliano Brolli

Thruk version 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title=[TITLE] Reflected XSS on 'host' and 'title' parameters. A malicious user leveraging this vulnerability could inject arbitrary JavaScript into status.cgi. The malicious payload will then be triggered every time an authenticated user browses the page containing it.

The vulnerable functionality can be reached through the following URLs:

• /thruk/#cgi-bin/status.cgi?host=[HOSTNAME]&style=detail
• /thruk/#cgi-bin/status.cgi?style=combined&title=[TITLE]
  

A PoC is possible inserting the malicious payload in one of the host or title fields (GET Request):

• --></script><script>alert(1337)</script>

This occurs due to the closure of a comment, as demonstrated in the next screenshot.