full-disclosure - Reflected XSS Attacks vulnerabilities in Symantec WEB Gateway 5.1.1.24 (CVE-2013-5013)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAOmMdVtmbEYY-baszmpQV_R9m+9B7DaZav_cYxEr8bat3FYw+Q@mail.gmail.com>
Date: Mon, 10 Feb 2014 17:42:20 -0200
From: William Costa <william.costa@...il.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Reflected XSS Attacks vulnerabilities in Symantec
 WEB Gateway 5.1.1.24 (CVE-2013-5013)

I. VULNERABILITY

-------------------------

Reflected XSS Attacks vulnerabilities in Symantec WEB Gateway 5.1.1.24

II. BACKGROUND

-------------------------

Symantec Corporation is an American computer security, backup and
availability solutions software corporation headquartered in Mountain
View, California, United States. It is a Fortune 500 company and a
member of the S&P 500 stock market index

III. DESCRIPTION

-------------------------

Has been detected a Reflected XSS vulnerability in Symantec Web Gateway.

The code injection is done through the parameter "operand[]" in the
page "/spywall/blacklist.php?variable[]=&operator[]=&operand[]="

IV. PROOF OF CONCEPT

-------------------------

The application does not validate the parameter "operand[]" correctly.

https://10.200.210.144/spywall/blacklist.php?variable[]=&operator[]=&operand[]=jjjj'><script>alert(document.cookie);</script>

V. BUSINESS IMPACT

-------------------------

An attacker can execute arbitrary HTML or script code in a targeted

user's browser, that allows the execution of arbitrary HTML/script
code to be executed in the context of the victim user's browser
allowing Cookie Theft/Session Hijacking, thus enabling full access the
box.

VI. SYSTEMS AFFECTED

-------------------------

Tested Symantec Web Gateway Version: 5.1.1.24

VII. SOLUTION

-------------------------

All data received by the application and can be modified by the user,

before making any kind of transaction with them must be validated

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140210_00

By William Costa

william.costa@...il.com

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/