bugtraq - [DCA-2011-0016] - Tufin SecureTrack Cross Site Script

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 4 Apr 2012 08:55:11 -0300
From: Ewerson Guimarães (Crash) - Dclabs <crash@...abs.com.br>
To: bugtraq@...urityfocus.com
Subject: [DCA-2011-0016] - Tufin SecureTrack Cross Site Script

[Discussion]

- DcLabs Security Research Group advises about the following vulnerability(ies):

[Software]

- Tufin SecureTrack

[Vendor Product Description]

- Features powerful tools to track changes, analyze device
configurations, optimize rule bases, and more on leading vendor
firewalls, routers, switches and network devices. Maintains a
continuous audit trail for accurate accountability and provides
built-in reports such as PCI DSS to comply with standards and reduce
audit preparation time by 50%.

- Site: http://www.tufin.com


[Advisory Timeline]

- 12/02/2011 -> First Contact requesting security department contact;
- 12/02/2011 -> Vendor reply

- 12/05/2011 -> New Contatc
- 12/09/2011 -> Advisory sent to Vendor
- 12/09/2011 -> Coordinate to disclosure
- 03/15/2012 -> Bug Fixed

- 04/04/2012 -> Public disclosure

[Bug Summary]

- Persistent/Stored Cross-Site Scripting (XSS) (A common user can
launch Xss attack using the any fields (First Name,Last Name and
others). This Xss is executed in any other logged user context,
included admin)


- Non-Persistent Cross-Site Scripting (XSS) - Must a valid session.

[Impact]

- Medium


[Affected Version]

- 6.1 build 20596

[Not Affected Version]

6.1 HF10, build 22595



[Bug Description and Proof of Concept]


- Exploiting the HTML-injection issue allows an attacker to execute
HTML and Java Script code in the remote user context to steal
cookie-based authentication credentials or to control how the site is
rendered to the user; other attacks may also be possible.

- Moreover, Cross Site Scripting (XSS) vulnerabilities are caused due
to lack of input validation. This allows malicious people to inject
arbitrary HTML and script code. More info at:
http://en.wikipedia.org/wiki/Cross-site_scripting



All flaws described here were discovered and researched by:

Ewerson Guimaraes aka Crash

DcLabs Security Research Group
crash (at) dclabs <dot> com <dot> br

[Patch(s) / Workaround]


Update to 6.1 HF10, build 22595


[Greetz]
DcLabs Security Research Group.

-- 
Ewerson Guimaraes (Crash)
Pentester/Researcher
DcLabs Security Team
www.dclabs.com.br