[R1] Sophos XG Firewall login.jsp utype Parameter Reflected XSS

Sophos XG Firewall provides login pages for users at https://[target]/userportal/webpages/myaccount/login.jsp and administrators at https://[target]:4444/webconsole/webpages/login.jsp. These links can insert a value into the "username" login field through the "utype" parameter. For example, the following will pre-populate the "username" field to be albino_lobster:

https://[target]:4444/webconsole/webpages/login.jsp?utype=1albino_lobster

An attacker can also inject JavaScript through this method. The following will create a popup box that says “LOBSTER” when the user mouses over the username field:

https://[target]/userportal/webpages/myaccount/login.jsp?utype=lalbino_lobster%22%20onmouseover=%22alert(%27LOBSTER%27);%22

Note that Google Chrome detects/disables these attacks but Mozilla Firefox does not. Additionally, the Sophos XG Firewall comes with default admin credentials of "admin/admin" that can be used with the admin HTTP interface (port 4444) and SSH, as seen on page 8 of the Sophos XG Firewall Administrator Guide.