bugtraq - CVE-2015-2223: Palo Alto Traps Server Stored XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201503291658.t2TGwmbJ018530@sf01web2.securityfocus.com>
Date: Sun, 29 Mar 2015 16:58:48 GMT
From: michael.hendrickx@...pag.com
To: bugtraq@...urityfocus.com
Subject: CVE-2015-2223: Palo Alto Traps Server Stored XSS

------------------------------------------------------------------------
Product: Palo Alto Traps Server (formerly Cyvera Endpoint Protection)
Vendor: Palo Alto Networks
Vulnerable Version(s): 3.1.2.1546
Tested Version: 3.1.2.1546
Advisory Publication: 29 March 2015 
Vendor Notification: 17 October 2014 
Vulnerability Type: Stored Cross Site Scripting 
CVE Reference: CVE-2015-2223
Risk Level: High
Solution Status: 
Discovered and Provided: Michael Hendrickx, help AG
------------------------------------------------------------------------

About the product:
Palo Alto Traps is an advanced endpoint protection suite that detects attacks such as memory corruption, executable child processes, DLL hijacking, etc.  Aside from optionally blocking it, it sends this “trap” to a central server for logging purposes.

About the vulnerability:
An attacker can send a SOAP request with JavaScript embedded inside it, which gets stored in the database.  When an administrator monitors the Traps’ admin screen and opens details about the vulnerability, the JavaScript is executed on the admin browser.

The XSS works in the <b:Arguments>, <b:FileName> and <b:URL> parameters, for example:

  <b:Arguments>"C:\\Users\\Michael\\fake.exe" 
    &#0000060;script&#0000062;
      alert("xss");
    &#0000060;/script&#0000062;
  </b:Arguments>

A POC script can be found at the following URL:
https://github.com/ndrix/random-scripts/blob/master/pa_traps_xss.rb

------------------------------------------------------------------------

Solution:

The vendor was notified back in October 2014, and a we’ve sent a few follow ups since.  Contact the vendor for the patch details.  

References:

[1] help AG middle East: http://www.helpag.com/ 
[2] Palo Alto Traps: https://www.paloaltonetworks.com/products/endpoint-security.html 
------------------------------------------------------------------------