Summary

The error page was changed to echo attacker's input to entice users to visit a malicious site. Please note that script tags are properly sanitized so XSS or html injection is not possible here.

Description

The error page was changed to echo attacker's input to entice users to visit a malicious site. Please note that script tags are properly sanitized so XSS or html injection is not possible here. Vulnerable parameter is "error=".

Impact

Attacker can present victim with false error page to entice victim to perform a certain action.

Step-by-step Reproduction Instructions

(1) Go to https://admin.move.mil/?error=INVALID%20REQUEST%0D%0AGO%20TO%20EVIL.ORG%20FOR%20HELP
(2) Observe the false message due to text injection vuln
(3) Change the parameter error= to present a false message to the victim.

Product, Version, and Configuration (If applicable)

https://admin.move.mil/
##Suggested Mitigation/Remediation Actions
Prevent users from injecting content in the error message

References:

https://hackerone.com/reports/181594
https://owasp.org/www-community/attacks/Content_Spoofing

For more information

https://dp3.atlassian.net/browse/MB-6094