Arista NextGen Firewall Chaining Stored XSS to Root Remote C...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://bishopfox.com/blog/arista-nextgen-firewall-xss-to-rce-chain
• Blog Title: Arista NextGen Firewall: Chaining Stored XSS to Root Remote Code Execution
• Suggested Section: Pentesting Web -> XSS (Cross Site Scripting) and Pentesting Web -> Command Injection (add a subsection on chaining stored XSS in admin UIs to Java /bin/sh -c command injection on appliances)

🎯 Content Summary

This post describes a full exploit chain against the Arista Edge Threat Management Next-Generation Firewall (NG Firewall, formerly Untangle), showing how a stored XSS in the web management UI can be chained into authenticated command injection, ultimately yielding root-level RCE on the underlying Debian-based appliance. The NGFW exposes a Java web admin UI (under Apache/Tomcat) as the sole management interface; internally it shells out for diagnostics and reporting. A stored XSS in a configurati...

🔧 Technical Details

Key tricks described:

1. Stored XSS in high-privilege management UIs for session theft: Find configuration or comment fields that are stored and later rendered without proper output encoding. Inject JavaScript that exfiltrates document.cookie to an attacker-controlled endpoint. Because many appliances do not mark cookies as HttpOnly or bind them to IP/UA, a stolen session cookie can often be replayed to gain full admin access.

2. Enumerating admin-only endpoints after session hijacking: Once an administrator session is hijacked, systematically explore all authenticated features and hidden APIs (reports, diagnostics, backup/restore). Proxy tools can help discover JSON endpoints and parameters that influence filesystem paths, command arguments, or database queries.

3. Generic command injection in Java shells using /bin/sh -c: Look for Java code that constructs shell commands with user-influenced strings and executes them via Runtime.exec or ProcessBuilder through /bin/sh -c. If parame...

🤖 Agent Actions

Summary of changes

• Added a new “JSON-RPC admin helpers shelling out (/bin/sh -c)" subsection to src/pentesting-web/command-injection.md, detailing how the Arista NGFW chain abuses a reflected XSS entry point to replay JSON-RPC calls that reach a Java handler spawning /bin/sh -c, plus concrete attack workflow and mitigation guidance.
• Documented the unauthenticated curl -skI https://<target>/capture/handler.py/load_rpc_manager probe from the Bishop Fox research as a quick way to spot exposed captive-portal handlers before attempting the chain.
• Extended the references section with the Bishop Fox blog post used for the update.

Testing

• Not applicable (documentation-only changes).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://bishopfox.com/blog/arista-nextgen-firewall-xss-to-rce-chain

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> XSS (Cross Site Scripting) and Pentesting Web -> Command Injection (add a subsection on chaining stored XSS in admin UIs to Java /bin/sh -c command injection on appliances)".

Repository Maintenance:

• MD Files Formatting: 914 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0