Executive Summary

This vulnerability exists in SohuTV CacheCloud up to version 3.2.0, specifically in the doUserList function of the UserManageController.java file. It allows an attacker to perform cross-site scripting (XSS) attacks by manipulating this function. The attack can be initiated remotely, and the exploit is publicly available.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to cross-site scripting attacks, which may allow attackers to execute malicious scripts in the context of a user's browser. This can result in unauthorized actions, such as stealing session tokens, defacing web content, or redirecting users to malicious sites. However, the CVSS scores indicate a relatively low severity with limited impact on confidentiality and availability, but some impact on integrity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the vulnerable endpoint `/manage/user/list` for reflected Cross-Site Scripting (XSS) by injecting malicious payloads into the parameters `searchChName` and `searchBizName`. A practical detection method is to send crafted HTTP POST requests with XSS payloads in these parameters and observe if the payload is reflected unencoded in the response. For example, using curl or Python requests to send a payload such as `<input autofocus onfocus=alert('zast-xss')>` in `searchChName` and checking if the alert triggers or if the payload appears in the response HTML unescaped. A sample curl command might be: `curl -X POST -d "searchChName=<script>alert('xss')</script>&searchBizName=test" https://target/manage/user/list -H "Content-Type: application/x-www-form-urlencoded"` and then inspecting the response for the injected script. Monitoring web server logs for suspicious payloads targeting these parameters can also help detect exploitation attempts. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include: 1) Avoid using the vulnerable version of SohuTV CacheCloud (up to 3.2.0) and upgrade to a version where this vulnerability is fixed if available. 2) If upgrading is not possible, implement input validation and output encoding on the parameters `searchChName` and `searchBizName` to neutralize malicious scripts before rendering them in the web page. 3) Apply web application firewall (WAF) rules to detect and block malicious payloads targeting the `/manage/user/list` endpoint. 4) Restrict access to the vulnerable endpoint to trusted users only, since exploitation requires authentication. 5) Monitor logs for suspicious activity related to these parameters. Since the project has not responded with a patch yet, consider replacing the software with an alternative if feasible. [2, 3]

Useful 0 Not Useful 0