| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAK9-XBq6hVYcpn-M_Nsf6=SuYdHxTcesBFTd52FyxYoyCpvSdg@mail.gmail.com> Date: Thu, 5 Oct 2017 10:24:49 +0200 From: Giovanni Cerrato <cerratogianni@...il.com> To: fulldisclosure@...lists.org Subject: [FD] CVE-2017-9292, Lansweeper 6.0.0.63 XSS vulnerability ============================================= - Release date: October 05th, 2017 - Discovered by: Giovanni Cerrato, Giovanni Guido and BackBox team - Severity: Medium ============================================= I. VULNERABILITY ------------------------- Lansweeper XSS vulnerability. II. INTRODUCTION ------------------------- Lansweeper an Asset Management and Network Inventory Tool (v6.0.0.63 and probably all previous versions) is affected by a Xss vulnerability. III. DESCRIPTION ------------------------- 1) REFLECTED CROSS SITE SCRIPTING The application is affected by Cross Site Scripting vulnerabilities. An attacker can use this vulnerability to construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user’s browser in the context of that user’s session with the application. The attacker-supplied code can perform a wide variety of actions, such as stealing the victim’s session token or login credentials, performing arbitrary actions on the victim’s behalf, and logging their keystrokes. Reference: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) · URL: hostname/GlobalActions.aspx?action=getthumbnail · Vulnerable parameters: username, userdomain, upn · Method: POST POC (proof of concept) The vulnerability can be trigged via a POST request as shown in the following PoC's. Payload username parameter: POST /GlobalActions.aspx?action=getthumbnail HTTP/1.1 type=1&id=-2&size=75&username=<script>alert(1)</script>&userdomain=&upn= Payload userdomain parameter: POST /GlobalActions.aspx?action=getthumbnail HTTP/1.1 type=1&id=-2&size=75&username=test&userdomain=<script>alert(1)</script>&upn= Payload upn parameter: POST /GlobalActions.aspx?action=getthumbnail HTTP/1.1 type=1&id=-2&size=75&username=test&userdomain=&upn=<script>alert(1)</script> IV. BUSINESS IMPACT ------------------------- An attacker could perform a wide variety of actions such as stealing the victim’s session token or login credentials, performing arbitrary actions on the victim’s behalf, and logging their keystrokes. V. SYSTEMS AFFECTED ------------------------- Version 6.0.0.63 is vulnerable (probably all previous versions) VI. SOLUTION ------------------------- Upgrade to version 6.0.0.65 or later. VII. REFERENCES ------------------------- lansweeper website: https://www.lansweeper.com/ https://www.lansweeper.com/changelog.aspx BUG: #542782 VIII. CREDITS ------------------------- The vulnerability has been discovered by: Giovanni Cerrato giovanni(dot)cerrato(at)aizoon(dot)it Giovanni Guido giovanni(dot)guido(at)aizoon(dot)it BackBox team info(at)backbox(dot)org IX. ADVISORY TIMELINE ------------------------- April 21th, 2017: Vulnerability identification April 21th, 2017: First contact with vendor April 26th, 2017: Vendor notified April 26th, 2017: Vendor response; investigating May 2th, 2017: Vendor says that the vulnerability will be fixed in the new version May 11th, 2017: Vulnerabilty fixed (Bug 542782). Reference: https://www.lansweeper.com/changelog.aspx May 23th, 2017: CVE Requested May 29th, 2017: CVE received - "CVE-2017-9292" September 18th, 2017: Vulnerability published on backbox.org URL: https://backbox.org/membership/lansweeper-v6-0-0-63-xss-vulnerability/ October 04th, 2017: cve updated X. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. We accept no responsibility for any damage caused by the use or misuse of this information. <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> Mail priva di virus. www.avg.com <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2> _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists