安全研究
CVE-2024-5420 SEH UTN Server XSS：USB 设备管理接口的跨站脚本攻击
Thinking
2024-08-15
1 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
SEH UTN Server 的 USB 设备管理 Web 界面未过滤用户输入，攻击者通过构造恶意 URL 注入 JavaScript 窃取管理员会话。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9237680cb882a78cabe692469f9804a3d7cd833148885224483bbe979ecd9eefd7843618020f58e9b12a104172d6da54df72572904fe22d3194931aa5617260b328f1d6b1894a39c6c52d5a0526c3be4367d4b5bc80f310c276bd1cd93bb8b6b4df754cfad52bcf7cd5a9e6e9fa90f270e0f3d531efafe3f576fbdf2e344ac7d5a984d4274019d540250cb37d986c95fae9ec2039312351a58e556baa28a5be53ba3027f7b448c65a19e9e2df96d79b9384d24236070b7b961c1d7de0a3427c34dcd1089f5db18771c73ddd7829d44d6828c14dd738b0f58d697e83498d98060450cbbe463ea81970cf559f6ed32c22ddd0180497528472cef883fdacd7b3d3aaaeb7a87366027299fbd55860e0d9e85ee5ab14407c989b18db2dd48cd7400e5735c4cd65314e353804822004b9b5fc4f01013181d8778fb0e62539e3f140c3674955adcbc0621c13e8e1ba936008627e6f23c888eb0012f57bd1eda1363512377d71fe8db5be5fc628e8107bd8cf0504962075d0446e27daf64851e9ccb02a530648eac9985e787120e265b540aea0820b4caaaa75765dffa8c4e1f1890a2c25c66e00d48fb226c60c97e4088f1f9db9c45391c0186863058996f7d18d40567ec501c911ecf373ebb2049d4fbe09d99bc85789751463a6d883d6778494ca221621b1390e884d527cab54444d3ec2cbcf6a970b174c4494b9f0eddf585454b74b11a07c89693baffa691f365ac310568db109d85f30344a7cbd7f595913c43054dae1decc518953060dc24a341991a24ad952fd21a5f076f338168170483740709c682915103aeed2b9a45761a3f91448897e641e5d88fe0e565bb70767c285256215f472b3a8e88457df6b9cc9edf7fe5ead27b45c21ec360ecd77931185c6d5dc10093b4406e40ef7de8722c4cdc70dbbd10a751d6dcb0c033332f881d75e4a7e130186050c625e182514e5d2a819ada68bed102413bff1ca1acec72f1fc49bd9408dfbac2f12eb0a4be1656073ec274d8d64aad6b6e6aee35b4ad2fcc17c62fff75962c89f9f587611f47d5d5d99e2b1f27b3bb728ad429637f1d2864f8728c6a019c6261157cefe4806ed8a9c587c67e816cfc7797ba9af55411c8a35808ef0fbf951910c73b2a7561738c9120cc0f9062f2479de60471cbdd55f3c4887e895c8531bdb90c0790f196b430b1c4f3e13560fde7d19ace5137c4e8a18956af79055adcb18931a707a336ce7b02f88f4bf11d9ea3b125fdc63553fa55c82387c6859473b7dd5f9164fdd2ea67736371b0b88f3e65c5116c442c3561ccd60f63090b6de88a0322514c97d84adc23b2a5679e1e9845f6d15eb263eb407da0f992e55a748220426b0891a797045f161722c3e73328d06ad3e4f915ddacbad6f1faafb49214028302492c889762cc70414eca76a59a6f4a21ca768fa602ce9fb1d209b327b6206cff9b949ad7da8a2056f98316f0c6558a29d6555927e8a0378b7d22f527b72e76efe0d1f6b54bd1d172bc9f28dc2c387ce7ea0a5cb7d4828fcc78d58ba4608a9955bb19c639094eeb503432ae97830d64a789a76f02c2ec44f9907b6f348175ddf2e7e21bac7512f91301966356fa63ea8bd1a02cd25c1275d22425ac843c2da4347f8cd1c9f7dc61c23913f815e936a9d9aed460d9697d48ac7a38b4dacda668604829b39cded26255fa1de89b41c275c7c33b940193da7c2699ab0594df8c0b3e7b5d38199c0c315d69aff2f0feab5299df03315709556c1985446ad5bc90026f25bbaae63da34050e08c5f1cf57a0745a5f57615974c7ec0f2769bb436746fda51f7d7a8aa5b7fea11a90c53e09e740dbff45510453ad21c280cd5a9ac63669ce86c7ca630baa7e9d92c89feef04003c028d2c66e4fb8889d78f74392990295a68c9f76df108c056170db62662776096a8a0044edc05ba5bb9cf1e2c624dbbb47dadd746e8e921f88b46be77105d148764e2b6dacc2c5b1f9b61d115c99a7c1a1b3a987b3052cd2cdaae2197213ae6cf4346604ba80af4649aad025cfb5a4cb59d0bea3d2631a73398999b20f94e84a2eebdd98bfa0921ca98893068804eb304ab834d99080596e8d03febc6f0d092659cf25611536f67bfc81b24928239b490375f51c088392bd801876cafbc6eee7bfc905a47b95c5d1f9c164cf25e5d8b0b250a83e6b71914b25898343183c1820db41e9625be1a07e62e2c881ab47503e12c350bfc768636928372888b17429bdec3df3f935cb35a59d99db4d9de7fa68f541fa7da0f5ab2ea077c6a86751642d00cf947e3b92e5ec69d89ea6007ab4fdcaed3f0d70a75eebd491ce0cbbe0913db5399e99f6e8655d60e8cc4c9ea1cc855737451442e56248e23bd3b987f0045cff7af7c4fa1c8808d9453440d3410db57ea3b2edcc99118c70b1a0ed0fc69686ea19d34a85e6da214634d37eeee3b10fb7b5edced082302fa9292c8d670b25447f3e200ce604a738e04f7ea9561246f23a971aa6ed8e984a893c5302e1732f4d45c0dee9ecef1d68cc04492201097e21cc5618b59656869e8bf9c1e13715620e92627683fa3421a55e51d3a22c0a8360c9836e3068a5c272141f001064e879a6d7c5e2ceb47806de7fd9662ba1414ebe22ceb8230c372d8567e5cc2100dae77618c99ca3a67fa3b7c4842420e8a3d332216a615ed9c644e57106e31309ba1ef95c0b5a5b57e4097ee3e31984ff0c0dbddb8454e1f3bc35bda5538fa3913590bc6fb03a86520f714c2df68cf88080a714118b636e4cc6a6d9269badbbb1660de1aee415cbbfb55d80a0456f9f06aa53f85351d24c92d95a85a7ea40d0341e2adf042b9aea6aa98d3944019a408825921f8a208d885fa498512c9ce3ccd53568fc42f1fa538a88533ca3785be87b70f3d7ef084f2dfc93d66be31b36f9945139ee9afcfdd3ff632740639595ffcc12a4f04bd1018a4ccbaf4c581a5abd840220b93c84f8b8db96bdcda7d28a07301086595bfb22a953ae7faf06e759fb832aade5d1539aadb1f98d6286a89b274b8d383fced5aa3d92033b55820fc6805961b9f5e1cd614119d0f375fee6092248c33f57666149620310bcde704533cf6da72ffe284d042de2c82d891feea8efda125dd8a61166415d7bd3fd852217bff97f128b27a1d9de17322639fcc4b6e661c5a1e8da5a25d9f4ac7954929366cb2285f2d6ce48b07224a3ae017fb4846234c36533e9fd7f2dd020370bef68b1268b82d5ea0074e82f4c3cbfe12614d580bdb569064e20ea41caf71c1582ae69ef3f7b7fa62718736a1f412e64004ad37841b0fe3a27e38086caafd7c5de542c40495074aae0fd5b30408841c5b9e06c907a7a74d96c57183d74b5c3b0ccdb578d5080c8aa0aae40009d41a8fc69708f8c2c1aa715f721ef201412448a2e96a53d13f35fdf369c2534c63461835e3e32ae91c28605c5cc918c70f1057e46e7c4bb3e876b7cbad752a5fe6c52b64e9fefd6833e0ef5fce4344d4d7b8bbba4dc5e3042f63971733a3765e664816d47278aab70c9f2ac63c3bfc24a3f8b3e2dfc4e59e2df365651315e1342db1aab054c90283d2f209dfbe87e7ed12a98b9d89f7371388bb99ff865ccc9ac72a99a8891967d9777ad320a5c2cdfeb829fa5d04b16b7ee70621e207450b12af0e4ed84f788e520cc56f7a7811924519ba58996d93ee9a4a0b0e06d836bcef79f2c86e9221eee39cf630fa8fd2fc97b8143346a47641db6e7ab6d21d81638354dcc9e3a06ed8d356699d8877eb535c9dae9fb2f96628a4c9cb64598c06b415f56343f5681509f502ba0dd8905c65f7c6108747ee18948a83be8b3743bac04bc183a82ffef1661c5ff10760101cbc7a216d4d180a338a548e4fb9b9457160fac07c8236ba2ab47f50d9395b6b24de96d3b7f41994fd4cfef425b945cc69e4b7564237cf1c1a8697743d6498e73f2fbc008f93d1c4e90911cfaf5368f551dbef16776502ab37f02126d207b039d86d9533e8c15aab607dbab39c7189304a8fc21381c3d8fcae4b7184a8834231597b05297b9c86b90f366d758620845db8b91eca6864c89a422d19afe5f1ac50c3f179a590c54ca1aafe23a62452a581e753e73ed2d4a5b30c730a91e5fce6f64bbffccd31053e3a0d7e22acc8c09aa3912d84bfe34045bcb7a7da77db71e6208c459bdf95081e21d99762b4929217f3454f9b33e0c2fea571b13422b2dcf385207a3020a5a838acb05cb992a08cd8a73f344ec6595914506d50ed4bf39ee999687c2e0e55d82006990fd59cc0aeed5c28b0cb93022acb9c9e2112a86b655ba8224fba7fc46e111ea52254a15bd8b3e0320d2eb3b3061550f44b8f3a901c6f4f1aed732daed2b53ba150ac2e93f6a1e8b0e1373cf3d80e5fcf1a5a3f21710c45610f441a1c486db1d0928014629a16830edfa7d99d273c760d2a66c4e39692c2ce584cb94af8da0648f0102237012bb66b8c8503b2558c5e1c56fe95dda9e4fdaa8753c6501d2c7be124f936e27fd8a93b3b46afb57fae79820dd1d5909ac221b8ebbc3a31d0a1517bd665fa5499eb2bf6076fde6dfa41c9985ec744ff1ed18088d7013c542a1807488cef12dc6c113252173af47672a1d9595dc4e90ae14c9f3ac1b21f8db4c69b33dd2f2e507b1b23afc8b75eab39a37c5a4d8c838038d235d390f401aa5ccc71eff8fe1c789b8d9932c6de2da19a655391de6e44792856ff5e60fb60a4ce24c7316367606287b313cf5e5d5257bfa3e2f851c0d6a0e249defdd7f92e057ff3b5c71c2aa02ab8a56ba24cb4a407d79a38b9bbd840f0dfe5cd3e365967a2fc8c08390265eb788933889831d6800054d42efd4ebe25f36162625b1c26c54168ef7fe81f96ed13309cce0cb5b535e7e20f4c12596053f575593288d3819a54e9a0ffd4d69e227efbaabd7b06f00f2d019f4571cc6d92ea0105b96c4af7cb4137e43eb3dce9d944087cd2946dbe2eb1fc419953f23b3e1756e4f20c002d16b3f092d85ad662d9fb4f6bf48089d1fc7fd23a525a8db71ba42e53ec0bbc06507bb48149ab04faa6ee0fc91e5d0105d81ae24a2af2a40c13fa5f8d9250999dd6d6135d6914296827f454a437547613c3e7d00a49c9396b225e2f9001fb441532773ced6c709dff073f9c76621f1ab3eafc1b0455890dc404674b09797f1fbb781bf558be2cb2e141ca17bb2c4fbe10e7d8a72849f2fc64142c14fa06fae103c6ad474af32eeccedd9a669d69da9dab0776ce3ab33d3e28ca3ece391a5d9d1b85cd8fa56954d6b81f15b4c4a0149ce3abc9b45927056334d2f61245f96792ef8b562061a012b87d6d89717917b157bf98d0c4d8653ccb0d474ec651513efaa4826e6a7f07c257fa38c0152ff890d7859eeec556a2dbad6d9797f7c55400a0a5f1040b5f9c9968f276dc10f5527c607b6a48ba1bd39034bb93c226d7ac8b0c5fd4ec91058c32551e7c814773d37fc9fc265f2f6fca0c3f0d66aff2539b97868fe2e82c681159cbe56ce197eaa4e8da9ee94e5740371eb96eb95054768f6dd18288f2171551eebad3f98aacf42de3195a7640c6a8f143a5ede964f3fe42dd881793963264cff4ad1cd482b4d0a999727dcce73a2d740c9797c010fc3f02f40dcd7cc0f68beaaee227920298d962b84359564b25ebd7399db0641416b1f2a4e41cf6edd7ad2e94e7be08db0e28244d402b22e22617801a1b62bec64e23515d14d63235b1302af04a293c8adcda7dbda03fb89320534c2040cfb012a7416b962f9c79e90c158642146819f0e6b6dc8377b2a20a829bb16c8884abc4db1f6739d00d31822d625366b5f5a319e43969604fbdae6b5dac57c3c57b36c0eb50fc776fe6adce6c51f91042517e890bc84084e8d383ff8d79259611fdd9b76a38b74dba4c79f39cdbb39801d6dbc837c729ebd9e9413b354732891b8d966be0cfa5450dcbcfec1635ef893c0c7417d3f4640a5d13da095f66f42e67dd497891feb50ea95bdc535d5790b206422cba25788070bbb77deb2738bb177c684f7aa8fa293f42eb95fd4f3aff9c4489c02081d043d1d38c4c392cc70cf2889a0227d17a3e4ec6e3435ff8e16bc15e5e4caefcde009c4d11e876142f7fd1f3f274858dc649f9211b476c6372605c8a5474321d6a090028cc68dda53f3280df4f6095cdbee3882861b2a035a80cb2dbc8b8e17f3d7071522e4ddf5f1ca192750907f4b536fb7113d42489b66ef8381ae0a132dc68fb393f32e9f55cf8d5a0ccdc406b9fbe6df1ea01d3ae200609f836795ae6a084398af3c6b0feec237290852db03e9792cdc76ce5c5eb27b14799c43dc6dac1271ebe867a300b301d41b7761131581aeeec67e60603d9b98a60d9678e2cabc591907198a61b23c91da6ad5bda6953dc58455d0318511829c8dac7fdefcec5be4dc752d8bab64fdde66108a9e96e6a1a12595d63e10ea5a207d4db5d0b8dfd55eeb927a150e825b2088e8d544accf22a92b0cfefd9ad282a0664e2198daa49e71552eebbfe0e29ea7e0296570ef09d8eaa2d864d455276271db1323f09a6a099ada2ab72cd561fc89cb47356e483bd45c4ebe7404776aeff7409ec05313c418a5d9a278cf8b171114ee58775d60d1c893862511cde63ea1274324c116521310a40b53adc5e61d9d6de1f709f4bc0a14a0748e112bcaa0587e499ceb2a98935a5816365912e78267da484357cd33248d2b58835d64b624a6c39700d490d031c4bcf43c8cc67f3abea5d3ab2bbd0d9bb813bd425b03dc382effae528d863584f390563f3c93a884e07ada3fbc8d0e4af44aa23d9d98297816c849853fc571653700c9f0357744620ea4e395a289341b4c1b74c46d09b00f388efed75d100e3ff155e07a163bc7cddd19ffcad8684d900e08950dfb38425b83f565b7ed86fbdc64740908cac3d0623d77a061b07992036317c10e655e57305fdca3f0a9f3b0113ead7657d14cd9579ef69ac702616cbf533de0cbcf5c502829216d7a745033617818d1822396259bca10e8cc0b40638c582d1f120a6e6bc9d1822bffaa272e281157b774c8654a558306e3214e84f81583fa68c22b03c3946adc44805f131eb3a25c51ba72544b3db71d77851e8327ef41f6b2be44586f0902c2869db486d2c34285cf87d2e39b30e7247df81cd9362410b365f6f45ed53f9ee99654f532a068168d18a2eef21ae8a4051145d141a37c2019d33fddba62c098347d0ef0d8da28ed0ef3ead4e45523db57a4698ab912ab66970d0d8630d9eb5e442a31f9d5cde85ad0104df14fdc2803c9cb358369d2d0ff4102dae9f0f8d3f2315850fbc4de63742ff7fc6e6e850bb8ac77a3934cc6c309c657bde0fce745368e7d5cfbd9bdf551cc820942c899b73ada50dd82f7f69f697e7ca06333f5c2767c1fa7f394919be258d24a8918542265eea84c62856e139db124699e9347d06b78853046e0107546c0578275598e54a7c927e63aa972165d218513625ea6c827856babcfd9b00c3400e6ace5650af7976ee3baeccb28cf78477ffbbfab1c1c58501cd42800168dc9db51da95a83ef9d0678c342cfb6cf585cde5a3edd61802e54e185b62c9711cd8e17730c582330424230a8ae70c51c753ca66a8b6c673c3c82584d7693f042d2367b6ca2c6ab9a5a981159887053b7a3e7aa68b34d3a32f8e7bcc45b5b476e1a8bb9d8702766af211598770b6d7fae61857ac3c7e5596083ba1a835f6a3910ebd9d6937b9222d776c6dbff2fa49704b601442691247e22757ede306d1eace7dc10615ca77e1ea002a7bc800a3e4863e435c7f88d31b9932e3fdb09c407f146839a8d3873dceeba642acc8329ae9dfa35c1a04da4176651ee3b5e3d5ebe3656cec894620fc78f341f6e8d86e7317b86361a251ae2ccd76de6c2ac7f2ec7acf13434f1c9f06ceeb2b316d87dec011eaf869da6d16a85ed818b7c7102e4c65a004f726c245b87cba919afed3abf03a7721536565e96829899e2103527e317e17d114c7162aea0a1067d5e9042b377ec31d8be3aefbf7b2c0126668128e7fb82641241341f139a2a17eba000edb57aece2016b95f30ca2e4a9b758f437c112fdd1dc20871c8f61a2facad5a96bec00f6502d159d53031d55d70caaa029532156c031c2b5ae6fadd66310f6254d05ef7bf6af01789f88fbd17cd69a355bef6c1e38599658ab8daffef31aef79b01ebfc5fb48e74552a2c41cc1133fa1300de8ca96c1bf9b41ecd0735a7cb799d3793d6bde4f1f620da454c1b2f55fc490f4fea45c47cda8c2b588e587972b4f2cf5fc89abc21a470c6a751eb73d05404b2b772316bd308c68c7fba2f6794f22495492a790acedd565069ff8e162789e16c7ff7166e5b25bd6eecbc48709932f51d4c78c72a55475d894462a45e66f1982bcd9be056f4e16edcdd8b9b231fa7b7fcb4cd0bb00b897efdb4bf5f3606f0591f668c5f70ee0a3dbe392ffb5355fd31ae87ac24e6e0f5de325998b05893137d855c669564df3d0b285b0b90be9b13e7504e4d45266044fa1019552dc1dc5315d2b89d558a2349e14ee46a2d4acf8fc231b863b9c09a5e4305da12ce7ae1b479001438785139e78badf1972e142552dd9ba0322df4411866a9c0dbd92d36d3848a92653b709a7bd492d8e2a66b6035eda0b862a5b6d96822ae3db2950c0a31608f13f45c0f19a49160ce7cbfd7bb7e68e7ccdc81343a7b2c0d7e61c9a3a5a3c0341e4ddbefbf7e44706478ef4dd545f617505e3402a432b83b1c1d6211e5383860cc01972f2c204ee45f94e5f4046784e38650fc6a08bc956c6b3e6d6de2215f644d46f73632d8fede7c278967c7fae8caabbf102c91d12b7c95080e98b64a750c6316e988f136a00b69d21accc6592d5f0429f455b4d0c44bb655f16cad7a7723f17bd3df238ac1db450349e6340e46613fea5fb7a027b151af3e267a8d0a86dae1c1456ca58d480b40136d8cdd7d34ee340392b6c2f2b1eb5c34bdc5eee3b9f11dbd8fa3a384e948206d0635c31040a44553eccb05a41d6b9385e4f9cae6eb6600b2ca9458ef233a85be8df6d6441720a57020cb25f54330c8da73f76762e779f2fbcfa98c72ad42330afc9dc7f0dcf25fba385842cfaf8bfd3fb4f95751cc61cb90102db4b16eea1272ae5b1da9c46cb5913e9593919b8616f864413b676fd161e44630787feb10f25e36449852d269c3e81367fdbe66a4411528c149c609b39e0941408fc2fc6eee46de33231f1929e398619f1671b5871298bc66aaab10c41304d03c5eab28e55dd64effaad0b0831d0c8dd2f89a710fdbf35f68ab392c9092974c870f21945eee714afe95a7182cbcda46d25ce1b1297456145546d765c8a2ed19b2c9186ea22c69cddcd930f238ec86e63b4451e953ed23972c46452dcc074adf4f95257e402f3e9c38cc00b2e82d5502700f292e7a47cd8d3a7a79a0ccda47092fc26334bb704bccc1b349fcae86517251d8903ac8e39ccb240c04dbcf7f7fc60c6eff096eaadfd768601535627475e45c4d7ccc32769e6ae5a2a490ac7f1522cf7df63ffad8ec205a2000736d25d40ddc8b4462307f893ea3b30339bd6e5b5f4350dec6ccff46e8a6f741319ad9eb4cb23d922f1691cf70ee0001cb763584fe2474e92a58ff10625376e8a1cbe19945b1e1a9ce75bc23af0fd8dfe81745ded858148eb3caa216f4be8fdb82006ea5232df871aab4e56eede57b5f941c747fbb5a715df6a1799eb6e4df99f77b0c0680837b4278c04c61dbc478cdf9d604a585a24fa0cc4c5d6ae75b83e49ff2558a8fbdc0e36e4c329df37c8958ddde0e04e3e48abcf8ffdfb032e95412f70fb727e3fdea316bf70071d77184b23f06173200dbb4bfa75ac90d2b7365c8c5fdb794abece163cc2f54c79c0bd4b138af0b3785e9a7bdbf0e396d39dd6ea2798ee8c552f73721a88df41b9cc856f39ce784e887b96c41b288a9b4274749dd180eca3d379e6b11b302c78fa39d5e91cc4023e5d4818ad0d48e5c94ead5fc1630481f2f864e8f676a54ec04ef39a29707d8a74afd879461f6824ab346815e87afe1e99b6d20b26fcf19f7df4d7ea623ef3e44af49a579b24e966ea2735c