############################################################################## # # Title : Adiscon LogAnalyzer 'highlight' Parameter Cross Site Scripting Vulnerability # Author : Sooraj K.S SecPod Technologies (www.secpod.com) # Vendor : http://loganalyzer.adiscon.com/ # Advisory : http://secpod.org/blog/?p=504 # : http://secpod.org/advisories/SecPod_LogAnalyzer_XSS_Vuln.txt # Software : LogAnalyzer 3.4.3 # Date : 30/05/2012 # ############################################################################### SecPod ID: 1041 30/05/2012 Issue Discovered 19/06/2012 Vendor Notified 19/06/2012 Vendor Acknowledge 20/06/2012 Issue Resolved Class: Cross-Site Scripting Severity: Medium Overview: --------- Adiscon LogAnalyzer is prone to cross-site scripting vulnerability. Technical Description: ---------------------- Adiscon LogAnalyzer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Input passed via the 'highlight' parameter in index.php is not properly verified before it is returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of a vulnerable site. This may allow an attacker to steal cookie-based authentication credentials and to launch other attacks. The vulnerability has been tested in LogAnalyzer 3.4.3. Other versions may also be affected. Impact: -------- Successful exploitation allows an attacker to execute arbitrary HTML and script code in a user's browser session in the context of a vulnerable site. Affected Software: ------------------ LogAnalyzer 3.4.3 and prior. Reference: --------- http://secpod.org/blog/?p=504 http://loganalyzer.adiscon.com http://secpod.org/advisories/SecPod_LogAnalyzer_XSS_Vuln.txt http://loganalyzer.adiscon.com/downloads/loganalyzer-3-4-4-v3-stable http://loganalyzer.adiscon.com/downloads/loganalyzer-v3-5-5-v3-beta http://loganalyzer.adiscon.com/security-advisories/loganalyzer-cross-site-scripting-vulnerability-in-highlight-parameter Proof of Concept: ----------------- http://www.example.com/?search=Search&highlight="<script>alert(document.cookie)</script> Solution: ---------- Update LogAnalyzer to version 3.4.4 or higher. Risk Factor: ------------- CVSS Score Report: ACCESS_VECTOR = NETWORK ACCESS_COMPLEXITY = MEDIUM AUTHENTICATION = NONE CONFIDENTIALITY_IMPACT = NONE INTEGRITY_IMPACT = PARTIAL AVAILABILITY_IMPACT = NONE EXPLOITABILITY = PROOF_OF_CONCEPT REMEDIATION_LEVEL = UNAVAILABLE REPORT_CONFIDENCE = CONFIRMED CVSS Base Score = 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) Credits: -------- Sooraj K.S of SecPod Technologies has been credited with the discovery of this vulnerability.