bugtraq - Reflected cross-site scripting(XSS) Vulnerability in Manage Engine AD Audit Manager Plus Admin Panel(Build 6270)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201503100917.t2A9HW4m010294@sf01web3.securityfocus.com>
Date: Tue, 10 Mar 2015 09:17:32 GMT
From: harish.ramadoss@...pag.com
To: bugtraq@...urityfocus.com
Subject: Reflected cross-site scripting(XSS) Vulnerability in Manage
 Engine AD Audit Manager Plus Admin Panel(Build 6270)

#####################################
Title:- Reflected cross-site scripting(XSS) Vulnerability in Manage Engine AD Audit Manager Plus Admin Panel(Build 6270) 
Author: Harish Ramadoss - Help AG Middle East
Vendor: ZOHO Corp
Product: Manage Engine AD Audit Manager Plus
Version: All versions below Build 6270 are mostly affected
Tested Version: Build 6270
Severity: Medium
CVE Reference: CVE-2015-1026

# About the Product:
ADManager Plus is a Windows Active Directory Management and Reporting Solution that helps AD Administrators and Help Desk Technicians with their day-to-day activities. The software handles a variety of complex tasks like Bulk Management of User accounts and other AD objects, Delegate Role based access to Help Desk Technicians, and generates an exhaustive list of AD Reports,

# Description:
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This leads to compromising the whole domain as the application normally uses privileged domain account to perform administration tasks.

# Vulnerability Class:
Reflected cross-site scripting(XSS) - hhttps://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29

# How to Reproduce: (POC):

1. “technicianSearchText” parameter is vulnerable to XSS on “Help Desk Technician” page. The page can be found at : AD Delegation -> Help Desk Technician
2. "rolesSearchText" parameter is vulnerable to XSS on “Help Desk Roles” page. The page can be found at : AD Delegation -> Help Desk Roles

Proof of Concept code to test XSS : <b onmouseover=alert(document.cookie)>Hover over me!</b>

# Disclosure:
Discovered: December 08, 2014
Vendor Notification: Jan 22, 2015
Public Disclosure: Mar 10, 2015

# Affected Targets:
All versions below Build 6270 are mostly affected. On all platforms (Actually platform doesn't affect the issue).

# credits:
Harish Ramadoss
Information Security Analyst
Help AG Middle East

#References:
[1] help AG middle East http://www.helpag.com/.
[2] https://www.manageengine.com/products/ad-manager/
[4] https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29(XSS)
[5] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVEĀ® is a dictionary of publicly known information security vulnerabilities and exposures.