// For flags

CVE-2008-4918

SonicWALL Content-Filtering Universal Script Injection Vulnerability

Severity Score

4.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering, which is not properly handled in the CFS block page, aka "universal website hijacking."

Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en SonicWALL SonicOS Enhanced anterior a v4.0.1.1, como el utilizado en SonicWALL Pro 2040 y TZ 180 y 190; permite a atacantes remotos inyectar secuencias de comandos Web o HTML en sitios web de su elección a través de una URL a un sitio que se basa en el bloqueo de filtrado de contenidos; esto no se maneja adecuadamente en la página de bloqueo CFS. También se conoce como "secuestro universal del sitio web" (universal website hijacking).

This vulnerability allows remote attackers to execute a script injection attack on arbitrary sites through vulnerable installations of SonicWALL. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page or open a malicious web link.
The specific flaw exists in the default error page displayed when a user requests access to a web site that is blocked based on the devices content-filtering rules. Insufficient sanity checks allow an attacker to craft a URL that will trigger an error and simultaneously inject a malicious script. As the browser is unable to differentiate between content delivered from the original top level site requested and the inline device, the script injection occurs under the context of the target domain. This can result in various further compromise.

*Credits: Adrian 'pagvac' Pastor | GNUCITIZEN | www.gnucitizen.org
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-10-30 CVE Published
  • 2008-10-30 First Exploit
  • 2008-11-04 CVE Reserved
  • 2024-07-26 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sonicwall
Search vendor "Sonicwall"
Sonicos Enhanced
Search vendor "Sonicwall" for product "Sonicos Enhanced"
< 4.0.1.1
Search vendor "Sonicwall" for product "Sonicos Enhanced" and version " < 4.0.1.1"
-
Affected
in Sonicwall
Search vendor "Sonicwall"
Pro 2040
Search vendor "Sonicwall" for product "Pro 2040"
--
Safe
Sonicwall
Search vendor "Sonicwall"
Sonicos Enhanced
Search vendor "Sonicwall" for product "Sonicos Enhanced"
< 4.0.1.1
Search vendor "Sonicwall" for product "Sonicos Enhanced" and version " < 4.0.1.1"
-
Affected
in Sonicwall
Search vendor "Sonicwall"
Tz 180
Search vendor "Sonicwall" for product "Tz 180"
--
Safe
Sonicwall
Search vendor "Sonicwall"
Sonicos Enhanced
Search vendor "Sonicwall" for product "Sonicos Enhanced"
< 4.0.1.1
Search vendor "Sonicwall" for product "Sonicos Enhanced" and version " < 4.0.1.1"
-
Affected
in Sonicwall
Search vendor "Sonicwall"
Tz 190
Search vendor "Sonicwall" for product "Tz 190"
--
Safe