Skip to content

Commit

Permalink
Update CVE-2023-24488 - Citrix Gateway Open Redirect and XSS.bcheck
Browse files Browse the repository at this point in the history
This will avoid false positives due to the fact that some 404 status pages returns the introduced parameter encoding the "<" and ">" characters, but not the ".", so "document.cookie" appears but the rest of the payload is as introduced, "%3Cscript%3Ealert(document.cookie)%3C/script%3e".
  • Loading branch information
whoissecure authored Aug 9, 2023
1 parent c21a7e2 commit 91c0590
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ given host then
method: "GET"
path: {potential_path}

if "document.cookie" in {check.response.body} then
if "<script>alert(document.cookie)</script>" in {check.response.body} then
report issue:
severity: medium
confidence: certain
Expand Down

0 comments on commit 91c0590

Please sign in to comment.