F-Secure Radar Cross Site Scripting

2018.02.17
Credit: Oscar Hjelm
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

F-Secure Radar Persistent Cross-Site Scripting Vulnerability CVE-2018-6189 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-6189 # Summary The application can suggest metadata tags for assets, and in doing so it can execute JavaScript entered previously by a malicious user. # Vendor Description F-Secure Radar is a turnkey vulnerability scanning and management platform. It allows you to identify and manage both internal and external threats, report risks, and be compliant with current and future regulations (such as PCI and GDPR compliance). It gives you visibility into shadow IT - to map your full attack surface and respond to critical vulnerabilities associated with cyber threats. Source: https://www.f-secure.com/en/web/business_global/radar # Remediation F-Secure has remediated this issue; no action required for cloud users or on-premise users receiving updates. # Technical Details The frontend application issues a PUT request to the server when metadata tags are updated: PUT /api/latest/vulnerabilityscans/tags/batch HTTP/1.1 Host: portal.radar.f-secure.com [...] The Tags parameter in the JSON request body can be modified to contain arbitrary JavaScript, e.g.: [...], "Tags":["<img src=a onerror=\"alert(1)\">"], [...] This script will execute whenever the frontend attempts to suggest tags, e.g. when a user opts to add tags to a new asset. # Vulnerability Disclosure Timeline 2018-01-24 - Vulnerability discovered 2018-01-24 - Vendor contact & response 2018-02-01 - Vendor confirms fix 2018-02-15 - Public disclosure This post is also available at http://oscarhjelm.com/blag/2018/02/f-secure-radar-persistent-cross-site-scripting-vulnerability/ Best regards, Oscar Hjelm


Vote for this issue:
0%
100%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top