full-disclosure - [FD] F-Secure Radar Persistent Cross-Site Scripting Vulnerability

Open Source and information security mailing list archives

Message-Id: <6729387C-2562-4D50-B1B1-5F3A9FCB8E9B@oscarhjelm.com>
Date: Thu, 15 Feb 2018 22:03:29 +0100
From: Oscar Hjelm <contact@...arhjelm.com>
To: fulldisclosure@...lists.org
Subject: [FD] F-Secure Radar Persistent Cross-Site Scripting Vulnerability

F-Secure Radar Persistent Cross-Site Scripting Vulnerability

CVE-2018-6189
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-6189

# Summary
The application can suggest metadata tags for assets, and in doing so it can execute JavaScript entered previously by a malicious user.

# Vendor Description
F-Secure Radar is a turnkey vulnerability scanning and management platform. It allows you to identify and manage both internal and external threats, report risks, and be compliant with current and future regulations (such as PCI and GDPR compliance). It gives you visibility into shadow IT - to map your full attack surface and respond to critical vulnerabilities associated with cyber threats.
Source: https://www.f-secure.com/en/web/business_global/radar

# Remediation
F-Secure has remediated this issue; no action required for cloud users or on-premise users receiving updates.

# Technical Details

The frontend application issues a PUT request to the server when metadata tags are updated:
PUT /api/latest/vulnerabilityscans/tags/batch HTTP/1.1
Host: portal.radar.f-secure.com
[...]

The Tags parameter in the JSON request body can be modified to contain arbitrary JavaScript, e.g.:
[...], "Tags":["<img src=a onerror=\"alert(1)\">"], [...]

This script will execute whenever the frontend attempts to suggest tags, e.g. when a user opts to add tags to a new asset.

# Vulnerability Disclosure Timeline
2018-01-24 - Vulnerability discovered
2018-01-24 - Vendor contact & response
2018-02-01 - Vendor confirms fix
2018-02-15 - Public disclosure

This post is also available at http://oscarhjelm.com/blag/2018/02/f-secure-radar-persistent-cross-site-scripting-vulnerability/

Best regards,
Oscar Hjelm

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives