Persistent XSS on Aruba 800 Mobility Controller's login page

2007.11.20
Credit: Jan Fry
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


Ogólna skala CVSS: 4.3/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Brak
Wpływ na integralność: Częściowy
Wpływ na dostępność: Brak

Date Found: 17th July 2007 Vendor informed: 23rd July 2007 Confirmed by vendor: 13th September 2007 Description: Aruba 800 is vulnerable to a persistent XSS on the administrator login screen. An unauthenticated user can re-write the hidden parameter 'url' by requesting a link under the /screens/ directory: https://internalip:4343/screens/%22/%3E%3Cscript%3Ealert(1)%3C/script%3E The payload stays intact until another user makes a request under the /screens/ directory, prior to logging in. Consequences: An attacker may be able to cause execution of malicious scripting code in the browser of an admin user. Such code would run within the security context of the target domain. This type of attack can result in a persistent defacement of the target site, or the redirection of confidential information (i.e.: admin session IDs, passwords) to unauthorised third parties. Since this XSS is of persistent nature, the admin user wouldn't have to be tricked to visit a specially-crafted URL, but rather simply visit the Aruba 800 login page at some point. Severity: High Author: Jan Fry [jan.fry [at] procheckup.com] of ProCheckUp Ltd (www.procheckup.com) References: http://www.arubanetworks.com/products/mobility-controllers/aruba-800.php http://arubanetworks.com/support/alerts/aid-070907b.asc Note: the vulnerability was originally documented by Aruba Networks but no information was provided regarding the exploitation of this XSS vulnerability in a persistent way. Aruba Networks has now updated their 'AID-070907b' advisory to include additional information. ProCheckUp thanks Aruba Networks for working with us. Solution: update the firmware to version 2.5.4.25.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top