PR09-15: XSS injection vulnerability within HP System Management Homepage (Insight Manager) Vulnerability found: 11th October 2009 Severity: Medium Description: A XSS vulnerability has been found within HP System Management; Arising from insufficient input filtering. By using a specially-crafted link, and tricking the victim into clicking on it, an attacker can perform malicious attacks such as the following: - Hijack user accounts by stealing the victim's cookies that are assigned to the victim's browser by the vulnerable website - Hijack user accounts by injecting a "fake" html form on the html rendered by the victim's web browser - Redirect the victim to a malicious third-party website which would perform a phishing attack to steal the user credentials or exploit a vulnerability (i.e.: buffer overflow) on the victim's web browser in order to compromise the victim's workstation Notes: Authentication is normally needed, unless system has been configured to support anonymous autologin. Vulnerable Parameter: - servercert Successfully tested on: Version 2.1.15.210 Version v3.0.0.64 Version v3.0.0.68 version v3.0.2.77 Tested on Windows 2008 64bit and Centos/Red Hat enterprise Hardware Proliant DL380 G5 and DL360 G5 Proof of concept: http://target-domain.foo/proxy/smhui/getuiinfo?JS&servercert=%0064e43<script>alert(1)</script>7b3f58a689f Consequences: Attackers can force the victim's web browser to perform XSS/HTML injection in the security context of the vulnerable site in order to gather data from users who visit a page within the target site. Fix: HP have issued a fix, download the appropiate update for your operating system ensuring the sytem management agent is ay least version 6.0.0.96 or above. Credits: Richard Brain of ProCheckUp Ltd (www.procheckup.com) Legal: Copyright 2009 ProCheckUp Ltd. All rights reserved. Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if the Bulletin is not changed or edited in any way, is attributed to ProCheckUp indicating this web page URL, and provided such reproduction and/or distribution is performed for non-commercial purposes. Any other use of this information is prohibited. ProCheckUp is not liable for any misuse of this information by any third party. ProCheckUp is not responsible for the content of external Internet sites. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/