bugtraq - XSS in Kaseya version 6.2.0.0 web interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <16094c7d856c529b3a1ae98e39b7114c.squirrel@webmail.foofus.net>
Date: Fri, 20 Apr 2012 08:57:09 -0700
From: bede@...fus.net
To: bugtraq@...urityfocus.com
Subject: XSS in Kaseya version 6.2.0.0 web interface

1. Summary

The Kaseya version 6.2.0.0 web interface (and possibly other versions) is
vulnerable to Cross-Site Scripting in the "adminName" variable.

2. Description

By submitting malicious input such as the following, it is possible to
render javascript in the security context of the Kaseya server:

"><sCrIpT>alert(83212)</sCrIpT>

3. Proof of Concept

Use a HTML proxy such as WebScarab or Burp to intercept the HTML form post
as it is submitted, and replace the "adminName" with the input above.

4. Impact

Arbitrary JavaScript code may be executed in the security context of the
Kaseya web server.

5. Affected Products

"System Version 6.2.0.0" (from information pane of affected web server)
and possibly others.

6. Solution

Upgrade to the latest version.  According to Kaseya, "The fix was actually
deployed with hotfix #1686, Files Released to VSAUpdate, batch 499 on
1/30/2012 6:16:06 PM"

7. Timetable

2011-11-11 Advisory Written.  Vendor notified via web form and e-mail.
2012-01-31 Vendor acknowledges flaw.
2012-02-27 Vendor notifies of available fix.
2012-03-01 Attempt to coordinate release of information with vendor
2012-04-20 Published

8. Reference

(to be determined)

9. Credits

bede@...fus.net (Mark Lachniet)