TOTVS RM 12.1 Portal Login.aspx VIEWSTATE cross site scripting

Summaryinfo

A vulnerability described as problematic has been identified in TOTVS RM 12.1. This issue affects some unknown processing of the file Login.aspx of the component Portal. The manipulation of the argument VIEWSTATE results in cross site scripting. This vulnerability is reported as CVE-2023-4709. The attack can be launched remotely. Moreover, an exploit is present. Configuration settings should be changed. The vendor was initially contacted early about this disclosure but did not respond in any way. In a later statement he explains, that "the behavior described [...] is related to specific configurations that are not part of the default application setup. In standard production environments, the relevant feature (VIEWSTATE) is disabled by default, which effectively mitigates the risk of exploitation."

Detailsinfo

A vulnerability classified as problematic has been found in TOTVS RM 12.1. Affected is an unknown code block of the file Login.aspx of the component Portal. The manipulation of the argument VIEWSTATE with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity.

The weakness was disclosed 09/01/2023. This vulnerability is traded as CVE-2023-4709. The exploitability is told to be difficult. Successful exploitation requires user interaction by the victim. Technical details and a exploit are known. The MITRE ATT&CK project declares the attack technique as T1059.007.

It is declared as proof-of-concept. The vendor was initially contacted early about this disclosure but did not respond in any way. In a later statement he explains, that "the behavior described [...] is related to specific configurations that are not part of the default application setup. In standard production environments, the relevant feature (VIEWSTATE) is disabled by default, which effectively mitigates the risk of exploitation." By approaching the search of inurl:Login.aspx it is possible to find vulnerable targets with Google Hacking.

It is possible to mitigate the problem by applying the configuration setting .

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• TOTVS

Name

• RM

Version

• 12.1

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo