CVE-2025-0133
LOW NUCLEIPAN-OS 10.1.0-11.2.7 - Reflected Cross-Site Scripting in GlobalProtect Captive Portal
Title source: llmExploitation Summary
EIP tracks 7 public exploits for CVE-2025-0133. PoCs published by ynsmroztas, INTELEON404, dodiorne. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a Python-based exploit for CVE-2025-0133, targeting a reflected XSS vulnerability in GlobalProtect SSL VPN's `/ssl-vpn/getconfig.esp` endpoint. The exploit crafts a malicious URL with an XSS payload embedded in the `user` parameter, which triggers a JavaScript prompt when rendered.
Description
A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link. The primary risk is phishing attacks that can lead to credential theft—particularly if you enabled Clientless VPN. There is no availability impact to GlobalProtect features or GlobalProtect users. Attackers cannot use this vulnerability to tamper with or modify contents or configurations of the GlobalProtect portal or gateways. The integrity impact of this vulnerability is limited to enabling an attacker to create phishing and credential-stealing links that appear to be hosted on the GlobalProtect portal. For GlobalProtect users with Clientless VPN enabled, there is a limited impact on confidentiality due to inherent risks of Clientless VPN that facilitate credential theft. You can read more about this risk in the informational bulletin PAN-SA-2025-0005 https://security.paloaltonetworks.com/PAN-SA-2025-0005 https://security.paloaltonetworks.com/PAN-SA-2025-0005 . There is no impact to confidentiality for GlobalProtect users if you did not enable (or you disable) Clientless VPN.
Exploits (7)
This repository contains a Python-based exploit for CVE-2025-0133, targeting a reflected XSS vulnerability in GlobalProtect SSL VPN's `/ssl-vpn/getconfig.esp` endpoint. The exploit crafts a malicious URL with an XSS payload embedded in the `user` parameter, which triggers a JavaScript prompt when rendered.
This repository contains a Bash-based scanner tool for detecting CVE-2025-0133, a Reflected XSS vulnerability in Palo Alto GlobalProtect Gateway & Portal. It leverages nuclei and shodanx to automate the scanning process.
This repository contains a Python-based scanner for detecting CVE-2025-0133, a reflected XSS vulnerability in Palo Alto Networks GlobalProtect Portal (PAN-OS). The tool tests multiple parameters with context-specific payloads and logs results for analysis.
This repository contains a functional exploit PoC for CVE-2025-0133, a reflected XSS vulnerability in Palo Alto PAN-OS GlobalProtect gateway and portal. The exploit leverages the `user` query parameter in the `getconfig.esp` handler to execute JavaScript in the context of the VPN portal.
This repository contains a writeup describing CVE-2025-0133, a reflected XSS vulnerability in Palo Alto Networks PAN-OS GlobalProtect gateway and portal. The vulnerability allows arbitrary JavaScript execution in the context of an authenticated user's browser via a crafted link.
This repository contains a Python script to scan for CVE-2025-0133, a reflected XSS vulnerability in Palo Alto's `getconfig.esp` endpoint. The script sends a probe request to detect Palo Alto and then tests for XSS by injecting a payload into the `user` parameter.
This repository contains a Python-based scanner for CVE-2025-0133, which targets a reflected XSS vulnerability in Palo Alto GlobalProtect gateways/portals. The script checks multiple URLs for the presence of an XSS payload and logs vulnerable endpoints.
Nuclei Templates (1)
http.favicon.hash:"-631559155" || cpe:"cpe:2.3:o:paloaltonetworks:pan-os"
icon_hash="-631559155"
References (1)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/U:Amber