INFOR EAM 11.0 Build 201410 Cross Site Scripting

2017.05.16
Credit: Yoroi
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 3.5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 6.8/10
Exploit range: Remote
Attack complexity: Medium
Authentication: Single time
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

Stored XSS in INFOR EAM V11.0 Build 201410 via comment fields ------------------- Assigned CVE: CVE-2017-7953 Reproduction steps: ------------------- 1. Log in with your EAM account 2. Go to the jobs page 3. Click on a record and open its page 4. Go to "Comments" tab 4. Click the add new comment button 5. Insert a comment containing javascript code, e.g. <img src=fakesource onerror="alert(document.cookie)"> Fake comment here 6. Save, and after page reloading the XSS should trigger Example: ------------------- PoC Screenshot: https://www.dropbox.com/s/2b859x9go8v9f2l/xss.png?dl=0 Exploitability ------------------- In EAM software user comments have read classification to every authenticated users. Any authenticated user could became a valid victim to the described attack by navigate (spontaneously or not) to the infected page. The comment visualization triggers injected javascript code. On the other side any user able to write a comment could become a possible attacker by introducing javascript into the comment body. Impact ------------------- By reading browser cookies an attacker could ultimately grab administrative credentials having access to each available EAM action. The vulnerability could ultimately allow an attacker to steal credential, leak sensitive data, trick user to download malware. Disclosure timeline ------------------- 26.04.2017 Vulnerability reported to vendor 15.05.2017 Advisory published


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top