============================================= INTERNET SECURITY AUDITORS ALERT 2006-007 - Original release date: April 27, 2006 - Last revised: December 1, 2006 - Discovered by: Jesus Olmos Gonzalez - Severity: 2/5 ============================================= I. VULNERABILITY ------------------------- The BlueSocket web administration is vulnerable to a Cross Site Scripting attack. II. BACKGROUND ------------------------- BSC 2100 product is included in the Blue Secure Family (www.bluesocket.com) BlueSecure Controllers provide high-performance, reliable, policy-based WLAN security and management solutions that have been deployed by hundreds of large institutions, enterprises, and public access providers. III. DESCRIPTION ------------------------- The admin.pl perl code don't sanitize the imputs and then wen it tries to rewrite the username at the input, html + script code could be rewrited and executed by the browser. This crossite is in the administration of the security product, it has been tested only in BSC 2100. Is it possible to send a fake email to the admin spoofing the product address, saying that the configuration is not ok and sending the special link. If the admin press the link and validate in aparently normal interface, his credentials will be sended to the attacker. If this is done with a good social engineering will be a great risk. IV. PROOF OF CONCEPT ------------------------- This POC will inject some html to modify the look and feel of the authentication, and attacker could inject script code to send credentials to him. https://somehost.somedomain.org/admin.pl?ad_name=%22%3E%3Ch1%3EXSS%20BUG %3C/h1%3E%3C!-- V. BUSINESS IMPACT ------------------------- Credentials could be stolen due social engineering attacks. VI. SYSTEMS AFFECTED ------------------------- Versions prior 5.2 or without 5.1.1-BluePatch VII. SOLUTION ------------------------- Update to 5.2 version or apply 5.1.1-BluePatch VIII. REFERENCES ------------------------- Vulnerability item number 4484 in the Bluepatch V6 for 5.1.1.1 Release Notes. IX. CREDITS ------------------------- This vulnerability has been discovered and reported by Jesus Olmos Gonzalez (jolmos (at) isecauditors (dot) com). X. REVISION HISTORY ------------------------- April 27, 2006: Initial vendor contact. April 28, 2006: Vendor updates its near patch. June 21, 2006: Publication of the patch. September 16, 2006: Vendor confirms inclusion in referenced patch. September 17, 2006: Advisory revised. XI. DISCLOSURE TIMELINE ------------------------- April 26, 2006: The vulnerability discovered by Internet Security Auditors. December 1, 2006: Advisory finally Published XII. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors, S.L. accepts no responsibility for any damage caused by the use or misuse of this information.