*Overview-----------------------------------------------------------------------------------------------------------------------------* Vendor: Manage Engine Vulnerable Product: Desktop Central v.9.1.0 Build 91099 Vulnerability Type : Reflected Cross Site Scripting Vulnerability Vulnerable Version : v.9.1.0 Build 91099 Vendor Homepage: https://www.manageengine.com/products/desktop-central/download.html <https://www.manageengine.com/products/firewall/download.html> CVE-ID : NA Severity : Medium Author – Omkar Joshi Vulnerability Reported: 11/12/2015 Response From Vendor: 11/12/2015 Vendor Confirmation: 18/12/2015 Patch Released: 28/03/2016 Link: https://www.manageengine.com/products/desktop-central/cross-site-scripting-vulnerability.html *Product Description * -------------------------------------------------------------------------------------------------------------------------------- Desktop Central is integrated desktop and mobile device management software that helps in managing servers, laptops, desktops, smartphones, and tablets from a central location. Automate your regular desktop management routines like installing patches <https://www.manageengine.com/products/desktop-central/windows-patch-management.html>, distributing software <https://www.manageengine.com/products/desktop-central/windows-software-installation.html>, managing your IT Assets, managing software licenses <https://www.manageengine.com/products/desktop-central/software-license-management.html>, monitoring software usage statistics, managing USB device usage, taking control of remote desktops, and more. It supports managing both Windows, Mac and Linux operating systems. Manage your mobile devices to deploy profiles and policies, configure devices for Wifi, VPN, Email accounts, etc., apply restrictions on using camera, browser, etc., and to secure your devices like enabling passcode, remote lock/wipe, etc.Manage all your iOS, Android and Windows smartphones and tablets. *Proof of Concept URL * ----------------------------------------------------------------------------------------------------------------------------------- http://localhost:8020/scheduleReport.do?actionToCall=showScheduleReport *Credits & Authors* ------------------------------------------------------------------------------------------------------------------------------------- Omkar Joshi *Steps to Reproduce :* *Attack Scenario*: Step 1. Login into Desktop Central v.9.1.0 Step 2: Go to Reports. Step 3: Click on Add Schedule Report Step 4: Insert XSS payload in "To" parameter of "Specify Delivery Format". I have used "><img src=x onerror=prompt(document.cookie)> XSS payload Step 5: Then click on Save to submit the data and Script will get execute. *Impact of attack*: An attack can perform Cross Site Scripting attack and steal the cookie of other active sessions. An attacker would exploit a vulnerability within a website or web application that the victim would visit, essentially using the vulnerable website as a vehicle to deliver a malicious script to the victim’s browser. An attacker might be able to put stored XSS into the website. https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) *Recommendation*: Use an appropriate combination of white listing and blacklisting to ensure only valid and expected input is processed by the system. Furthermore, classes within the output tag libraries should also be modified to encode potentially dangerous characters with their HTML escape Counter parts. For more information refer the following link https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet