Message-ID: <4ef02bcc-226f-4655-9193-f1516892911e@sec-consult.com>
Date: Wed, 27 Nov 2024 08:00:32 +0000
From: SEC Consult Vulnerability Lab via Fulldisclosure
 <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] SEC Consult SA-20241127-0 :: Stored Cross-Site Scripting in
 Omada Identity (CVE-2024-52951)

SEC Consult Vulnerability Lab Security Advisory < 20241127-0 >
=======================================================================
               title: Stored Cross-Site Scripting
             product: Omada Identity
  vulnerable version: <v15U1, <v14.14 hotfix #309
       fixed version: v15U1, v14.14 hotfix #309
          CVE number: CVE-2024-52951
              impact: Medium
            homepage: https://omadaidentity.com/products/omada-identity/
               found: 2024-03-20
                  by: Daniel Hirschberger (Office Bochum)
                      SEC Consult Vulnerability Lab

                      An integrated part of SEC Consult, an Eviden business
                      Europe | Asia

                      https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"Omada Identity is a modern, enterprise-ready IGA solution that is deployed
on-premises, giving you full control over your data and security. Our solution
is easy to use, highly customizable, and gives you complete visibility into your
environment without having to write a single line of code but is completely
customizable to address any requirement. With built-in automation features,
Omada Identity can help you streamline your workflows, improve efficiency, and
strengthen your security posture."

Source: https://omadaidentity.com/products/omada-identity/


Business recommendation:
------------------------
Upgrade to version v15U1 or install hotfix #309 for v14.14.

SEC Consult highly recommends to perform a thorough security review of the
product conducted by security professionals to identify and resolve potential
further security issues.


Vulnerability overview/description:
-----------------------------------
1) Stored Cross-Site Scripting (CVE-2024-52951)
An authenticated user can inject JavaScript in the "Request Reason". The
injected JavaScript code will be executed if another user looks at the "History"
of this access request. An attacker can then execute arbitrary JavaScript
in the browser of other users which could for example be used for phishing attacks.


Proof of concept:
-----------------
1) Stored Cross-Site Scripting (CVE-2024-52951)
An authenticated user can submit an access request and has to specify a reason why
the access should be provided.

<1-1_request_access.png>

This request has to be intercepted and modified, e.g.:
--------------------------------------------------------------------------------
POST /workitemdlg.aspx?ACTTEMP=XXX&RURLID=YYY HTTP/1.1
Host: $SERVER
Cookie: oissessionid=$MYSESSION
[...]
Content-Type: application/x-www-form-urlencoded

[...]
1000104=Need+hello+access+and+bigfun<iframe+src=javascript:alert(document.domain)></iframe>&1000102=I+would+like+to+request+access+to+%5Bspecify+system%5D+so+I+can+perform+my+%5Bspecify+duties%5D+duties+related+to+my+work+as+a+%5Bspecify+position%5D.
[...]
--------------------------------------------------------------------------------

Afterwards, anyone who reviews the "History" of this access request will be
affected by the stored JavaScript code. Users who review the history requests are
usually managers who have to approve this request, so this vulnerability allows
reliably affecting higher-privileged users.

<1-2_trigger_xss.png>


Vulnerable / tested versions:
-----------------------------
The following version of the on-prem solution has been tested which was the latest
version available at the time of the test:
* 14.0.14.36

Previous versions of v14.14 hotfix #309 are affected according to the vendor, as
well as <v15U1.


Vendor contact timeline:
------------------------
2024-04-08: Contacting vendor through contract@...daidentity.com; no response.
2024-04-24: Contacting vendor through contract@...daidentity.com and
             info@...daidentity.com; no response.
2024-05-06: Contacting vendor through their "Contact Us" form;
             We were contacted by Sales and forwarded the email to them.
2024-05-08: CISO contacts us, we sent the advisory via provided Sharepoint
             link.
2024-05-13: Vendor confirms security issues. XSS is fixed now and hotfixes
             are created for their releases.
             Second finding was disputed and seems to be a misconfiguration.
             Removed issue 2 from advisory.
2024-05-27: Asking for a status update regarding XSS hotfixes.
2024-05-27: Vendor: May cloud update is scheduled for 29th May. On-prem
             release version v15U1 is planned for 12th June. Hot-fix for on-prem
             version 14.14 is also planned for 12th June.
2024-06-17: Asking if Hotfix is released
2024-06-21: Vendor: Hotfix #309 for v14.14 is released
2024-06-24: Vendor: asks if we are satisfied with the follow-up
             We agree and respect the wish to delay the publication of the
             advisory for at least one month.
2024-10-08: Asking vendor regarding CVE assignment.
2024-10-11: Vendor is waiting for internal confirmation regarding next steps,
             update hopefully next week.
2024-10-08: Asking for a status update, whether we should assign a CVE.
2024-10-31: Vendor responds with calculated CVSS vectors and asks for
             our opinions;
             We agree that the CVSS Base Score looks correct and ask to
             clarify if they want to register the CVE themselves or if
             we as a CNA should register it for them.
2024-11-18: Received CVE number from vendor;
             We provide our CVE details to the vendor and ask them
             to update the CVE entry.
2024-11-22: Vendor notifies us about the CVE update, gives us a
             green light for the publication and thanks us for our
             cooperation;
             We mention that we will publish it in the following week
             and also thank the vendor.
2024-11-27: Release of security advisory.


Solution:
---------
Upgrade to version v15U1 or install hotfix #309 for v14.14.


Workaround:
-----------
None


Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Eviden business
Europe | Asia

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Eviden business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: https://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Daniel Hirschberger / @2024

Download attachment "1-1_request_access.png" of type "image/png" (108032 bytes)

Download attachment "1-2_trigger_xss.png" of type "image/png" (108755 bytes)

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4201 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists