98 lines
No EOL
3.1 KiB
Text
98 lines
No EOL
3.1 KiB
Text
##############################################################################
|
|
#
|
|
# Title : Advantech WebAccess HMI/SCADA Software Persistence Cross-Site
|
|
# Scripting Vulnerability
|
|
# Author : Antu Sanadi SecPod Technologies (www.secpod.com)
|
|
# Vendor : http://webaccess.advantech.com/
|
|
# Advisory : http://secpod.org/blog/?p=569
|
|
# http://secpod.org/advisories/SecPod_Advantech_WebAccess_Stored_XSS_Vuln.txt
|
|
# Software : Advantech WebAccess HMI/SCADA Software 7.0-2012.12.05
|
|
# Date : 08/01/2013
|
|
#
|
|
###############################################################################
|
|
|
|
SecPod ID: 1046 10/12/2012 Issue Discovered
|
|
18/12/2012 Vendor Notified
|
|
No Response from vendor
|
|
08/01/2013 Advisory Released
|
|
|
|
|
|
Class: Cross-Site Scripting Severity: High
|
|
|
|
|
|
Overview:
|
|
---------
|
|
Advantech WebAccess HMI/SCADA Software Persistence Cross-Site Scripting
|
|
Vulnerability.
|
|
|
|
|
|
Technical Description:
|
|
----------------------
|
|
Advantech WebAccess HMI/SCADA Software Persistence Cross-Site Scripting
|
|
Vulnerability.
|
|
|
|
Input passed via the 'ProjDesc' parameter in 'broadWeb/include/gAddNew.asp'
|
|
(when tableName=pProject set) page is not properly verified before it is
|
|
returned to the user. This can be exploited to execute arbitrary HTML and
|
|
script code in a user's browser session in the context of a vulnerable site.
|
|
|
|
The vulnerabilities are tested in Advantech WebAccess 7.0-2012.12.05 Other
|
|
versions may also be affected.
|
|
|
|
|
|
Impact:
|
|
--------
|
|
Successful exploitation will allow a remote authenticated attacker to execute
|
|
arbitrary HTML code in a user's browser session in the context of a vulnerable
|
|
application.
|
|
|
|
|
|
Affected Software:
|
|
------------------
|
|
Advantech WebAccess HMI/SCADA Software 7.0-2012.12.05
|
|
|
|
Tested on Advantech WebAccess HMI/SCADA Software 7.0-2012.12.05 on Windows XP SP3
|
|
|
|
|
|
References:
|
|
-----------
|
|
http://secpod.org/blog/?p=569
|
|
http://webaccess.advantech.com
|
|
http://secpod.org/advisories/SecPod_Advantech_WebAccess_Stored_XSS_Vuln.txt
|
|
|
|
|
|
Proof of Concept:
|
|
-----------------
|
|
|
|
1) Login into project management interface
|
|
http://IP-Address/broadWeb/bwconfig.asp?username=admin
|
|
2) Go to http://IP-Address/broadweb/bwproj.asp
|
|
3) Create New Project with Project Description as <script>alert("XSS")<script>
|
|
4) Now Java script '<script>alert("XSS")<script>' will be executed,
|
|
when 'bwproj.asp' will be loaded
|
|
|
|
|
|
Solution:
|
|
----------
|
|
Fix not available
|
|
|
|
|
|
Risk Factor:
|
|
-------------
|
|
CVSS Score Report:
|
|
ACCESS_VECTOR = NETWORK
|
|
ACCESS_COMPLEXITY = MEDIUM
|
|
AUTHENTICATION = SINGLE INSTANCE
|
|
CONFIDENTIALITY_IMPACT = NONE
|
|
INTEGRITY_IMPACT = COMPLETE
|
|
AVAILABILITY_IMPACT = NONE
|
|
EXPLOITABILITY = PROOF_OF_CONCEPT
|
|
REMEDIATION_LEVEL = UNAVAILABLE
|
|
REPORT_CONFIDENCE = CONFIRMED
|
|
CVSS Base Score = 6.3 (High) (AV:N/AC:M/Au:SI/C:N/I:C/A:N)
|
|
|
|
|
|
Credits:
|
|
--------
|
|
Antu Sanadi of SecPod Technologies has been credited with the discovery of this
|
|
vulnerability. |