Executive Summary

CVE-2021-47920 is a reflected cross-site scripting (XSS) vulnerability in WebMO Job Manager version 20.0. It occurs because the application does not properly neutralize input in the search parameters 'filterSearch' and 'filterSearchType'. This allows remote attackers to inject malicious script code via crafted URLs, which is then executed in the victim's browser. The attack is non-persistent and can lead to session hijacking and external redirects. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to hijack user sessions, redirect users to malicious external websites, perform phishing attacks, and manipulate application modules. Exploitation requires minimal user interaction and no authentication, making it a significant risk for users of WebMO Job Manager 20.0. The injected scripts can execute arbitrary JavaScript in the victim's browser, potentially compromising user data and security. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the WebMO Job Manager's search functionality for reflected cross-site scripting (XSS) in the filterSearch and filterSearchType parameters. One way is to send crafted HTTP GET requests with script tags in these parameters and observe if the script is reflected and executed in the response. For example, you can use curl or a browser to send a request like: curl -v "https://<target>/cgi-bin/webmo/jobmgr.cgi?filterSearch=785101"><script>alert(1337)</script>&filterSearchType=" and check if the response contains the injected script code unescaped. Monitoring web server logs for suspicious requests containing script tags in these parameters can also help detect attempts to exploit this vulnerability. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the WebMO Job Manager interface to trusted users only, applying input validation and sanitization on the filterSearch and filterSearchType parameters to prevent script injection, and updating WebMO Job Manager to a version where this vulnerability is fixed if available. Additionally, educating users to avoid clicking on suspicious links and monitoring for unusual activity can help reduce risk until a patch is applied. [1, 2]

Useful 0 Not Useful 0