-
Notifications
You must be signed in to change notification settings - Fork 0
/
CiscoIronPort.7.1-XSS.txt
113 lines (62 loc) · 2.85 KB
/
CiscoIronPort.7.1-XSS.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
===============================
- Advisory -
===============================
Tittle: Cisco IronPort Security Management Appliance - Multiple issues
Risk: Medium
Date: 20.May.2013
Author: Pedro Andujar
Twitter: @pandujar
.: [ INTRO ] :.
The Cisco Security Management Appliance helps to enable flexible management and comprehensive security control
at the network gateway. Is a central platform for managing all policy, reporting, and auditing information
for Cisco web and email security appliances.
.: [ TECHNICAL DESCRIPTION ] :.
Cisco IronPort Security Management Appliance M170 v7.9.1-030 (and probably other products), are prone to several security issues
as described below;
.: [ ISSUE #1 ] :.
Name: Reflected Cross Site Scripting
Severity: Low
CVE: CVE-2013-3396
There is a lack of output escaping in the default error 500 page. When a exception occurs in the application, the error
description contains user unvalidated input from the request:
** PoC removed as requested by Cisco. **
.: [ ISSUE #2 ] :.
Name: Stored Cross Site Scripting
Severity: Medium
Due to a lack of input validation on job_name, job_type, appliances_options and config_master parameters which are then
printed unscapped on job_name, old_job_name, job_type, appliance_lists and config_master fields.
** PoC removed as requested by Cisco. **
.: [ ISSUE #3 ] :.
Name: CSRF Token is not used
Severity: Low
CVE: CVE-2013-3395
CSRFKey is not used in some areas of the application, which make even easier to exploit Reflected XSS Issues. In the /report area
of the application, we got no error even when completely removing the parameter CSRFKey;
** PoC removed as requested by Cisco. **
See: http://tools.cisco.com/security/center/viewAlert.x?alertId=29844
.: [ ISSUE #4 ] :.
Name: Lack of password obfuscation
Severity: Low
When exporting the configuration file even if you mark the "mask password" option, the SNMPv3 password still appears in cleartext.
.: [ CHANGELOG ] :.
* 20/May/2013: - Vulnerability found.
* 27/May/2013: - Vendor contacted.
* 11/Jul/2013: - Public Disclosure
.: [ SOLUTIONS ] :.
Thanks to Stefano De Crescenzo (Cisco PSIRT Team), because of his professional way of managing the entire process.
Stored XSS
CSCuh24755
Reflected XSS
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3396
SNMP password issue
CSCuh27268, CSCuh70314
CSRF
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3395
.: [ REFERENCES ] :.
[+] Cisco Content Security Management Appliance M170
http://www.cisco.com/en/US/products/ps12503/index.html
[+] Cisco Security Advisories
http://tools.cisco.com/security/center/publicationListing.x
[+] !dSR - Digital Security Research
http://www.digitalsec.net/
-=EOF=-