nck0099/jweb

XSS

jweb's Issues

juniper web device manager exploit

juniper web device manager XSS : EX4500-40F,SRX210HE
Vuln Description:  
Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected of a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.   Impact: High   The impact of an exploited XSS vulnerability on a web application varies a lot. It ranges from user's Session Hijacking, and if used in conjunction with a social engineering attack it can also lead to disclosure of sensitive data.
POC
Navigate to below URL:
The XSS payload on login page after "Error" parameter got executed as shown in the snapshot.
http://target.com/login?error=1%22%3Cscript%3Ealert(123)%3C/script%3E  

It is observed that XSS payload inserted has been executed successfully.