IoTGateway Cross-Site Scripting Vulnerability in Log Record Function

A cross-site scripting vulnerability has been identified in IoTGateway version 3.0.1. This issue allows remote attackers to execute arbitrary code by exploiting the Log Record Function. The vulnerability arises because the application improperly handles user-supplied data, specifically the 'X-Forwarded-For' header, which is used to log IP addresses. When this header is manipulated to include malicious scripts, the injected code is executed when the log data is rendered.

Impact

Exploitation of this vulnerability could lead to cross-site scripting, allowing for the execution of malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send an HTTP request to the API endpoint '/_Admin/ActionLog/Search' or '/_Admin/ActionLog/Details' with the 'X-Forwarded-For' header set to include a script payload, such as an image tag with an 'onerror' event. The backend will store this information without proper sanitization. When the log data is accessed, the injected script will execute, demonstrating the cross-site scripting vulnerability.