Date: Tue, 26 Aug 2008 12:25:58 +0200
From: "Luca.carettoni" <luca.carettoni@...isoft.com>
To: bugtraq@...urityfocus.com
Subject: Hopeless comments regarding the pointless  "HP System Management Homepage (SMH) Unspecified XSS"

=====================================================================================
Hopeless comments regarding the pointless 
"HP System Management Homepage (SMH) Unspecified XSS"

August 25, 2008

=====================================================================================
[Overview]

Since HP does not provide technical details in its security bulletins, it is really
difficult to track vulnerabilities and patches.

In the last few years several Cross Site Scripting vulnerabilities were reported 
against the HP System Management Homepage (SMH), however no technical details were
provided and it is still difficult to understand the real entity of this issue.
Whenever you search for information regarding this weakness in the public vulnerability 
databases, you can just read tons of incomplete or overlapped descriptions.

In order to understand the essence of the problem, have a look at:
http://www.securityfocus.com/bid/25953
Although it is ages away from being useful, it gives a compact overview of the flaw. 

This is the most useless indeed:
http://www.securityfocus.com/bid/24256

This document discusses three attack vectors found on the HP System Management 
Homepage(SMH).

=====================================================================================
[Impact]

Cross Site scripting (XSS)
 
Since it is a web management console, the Cross Site Scripting vulnerability has a
medium/high impact whenever it can be exploited.

=====================================================================================
[Technical Details] 

HP System Management Homepage (SMH) is prone to a XSS vulnerability because it 
fails to check the input parameter used to show a generic error message.

The vulnerability affects the "message.php" script. In detail, this page uses the 
JavaScript property "location.search" in order to create a contextual error message.
If the error ID provided in the URL does not match any valid code, a generic error 
is reported ("An unknown error (%INVALID_CODE%) occurred") instead. 

In the first versions of the HP System Management Homepage (probably <= 2.1.1) there
is a client-side only input validation:

<--- cut here --->
// handle possible active content in the pieces of the query string
   for(i=0; i<splitquery.length; i++)
   {
      splitquery[i] = unescape(splitquery[i]);
      splitquery[i] = splitquery[i].replace("\<script\>", "");
      splitquery[i] = splitquery[i].replace("\<\/script\>", "");
   }
<--- cut here --->

As you can see, the validation is obviously prone to fail.
Since it is not performed a global matching but just the first occurrence is replaced, 
it is trivial to bypass this control and successfully exploit the flaw.
Moreover we have to remember that multiple attack vectors without the HTML "SCRIPT" tag
exist in this situation.

In the second generation (for sure, after the version 2.1.4), finally a server side
validation was introduced. Unfortunately a simple NULL byte (%00) is enough
to bypass this checkpoint and provides the "location.search" as in the previous
vulnerable versions.
The version 2.1.11 is patched against this vulnerability.

The server side validation introduced in the second generation appears to be a black-list
based filter. All HTML tags tested were blocked by the filter. However the '<BGSOUND>' tag
has not been included in the black-list and it bypasses the server-side validation.
As reported by Rsnake in his XSS Cheat Sheet,'<BGSOUND>' tag is a valid attack vector in 
certain versions of Opera.

The latest version (2.1.12) has not yet been tested for this vector. Since only Opera
users are likely to be affected, the associated risk is relatively low.

=====================================================================================
[Vulnerable Versions] 

According to our analysis, this is probably the most comprehensive list: 

HP System Management Homepage 2.1.9
HP System Management Homepage 2.1.8
HP System Management Homepage 2.1.7 (TESTED for 2nd, 3rd vector)
HP System Management Homepage 2.1.6
HP System Management Homepage 2.1.5 (TESTED for 2nd, 3rd vector)
HP System Management Homepage 2.1.4
HP System Management Homepage 2.1.3
HP System Management Homepage 2.1.2
HP System Management Homepage 2.1.1
HP System Management Homepage 2.1
HP System Management Homepage 2.0.2 (TESTED for 1st vector)
HP System Management Homepage 2.0.1 (TESTED for 1st vector)
HP System Management Homepage 2.0
HP HP-UX B.11.31
HP HP-UX B.11.23
HP HP-UX B.11.11

HP System Management Homepage 2.1.11 
HP System Management Homepage 2.1.12 are NOT vulnerable using the 1st and 2nd vector.

=====================================================================================
[Exploit]

1st vector)
https://<IP>:2381/message.php?<script><script>alert('xss')</script></script>

2nd vector)
https://<IP>:2381/message.php?aa%00<script><script>alert('xss')</script></script>

3rd vector)
https://<IP>:2381/message.php?aa<BGSOUND SRC="javascript:alert('XSS');">

=====================================================================================
[Credits] 

Luca Carettoni (luca.carettoni[at]ikkisoft[dot]com) - http://www.ikkisoft.com/
Claudio Criscione (claudio[at]criscio[dot]net) - http://www.oversighting.com/
Lavakumar Kuppan (lavakumark[at]gmail[dot]com) - http://www.lavakumar.com/

=====================================================================================

Powered by blists - more mailing lists