SonicWALL GMS 7.2 Build 7221.1701 Cross Site Scripting

2014-07-23 / 2014-08-24
Credit: William Costa
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

I. VULNERABILITY ------------------------- Reflected XSS vulnerabilities in DELL SonicWALL GMS 7.2 Build: 7221.1701 II. BACKGROUND ------------------------- Dell&#174; SonicWALL&#174; provides intelligent network security and data protection solutions that enable customers and partners to dynamically secure, control, and scale their global networks. III. DESCRIPTION ------------------------- Has been detected a Reflected XSS vulnerability in DELL SonicWALL GMS. The code injection is done through the parameter "node_id" in the page “/sgms/panelManager?level=1&typeOfUnits=2&node_name=GlobalView&node_id=(HERE XSS)” IV. PROOF OF CONCEPT ------------------------- The application does not validate the parameter “node_ID” correctly. https://10.200.210.222:8443/sgms/panelManager?level=1&typeOfUnits=2&node_name=GlobalView&node_id=aaaaaaa'</script><body onload=alert(document.cookie)>&panelidz=0,4#tabs-4 V. BUSINESS IMPACT ------------------------- An attacker can execute arbitrary HTML or script code in a targeted user's browser, that allows the execution of arbitrary HTML/script code to be executed in the context of the victim user's browser allowing Cookie Theft/Session Hijacking, thus enabling full access the box. VI. SYSTEMS AFFECTED ------------------------- Tested DELL SonicWALL Analyzer v7.2 (build 7220.1700) VII. SOLUTION ------------------------- https://support.software.dell.com/product-notification/128245 By William Costa william.costa@gmail.com


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top