Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:27901
HistoryApr 09, 2012 - 12:00 a.m.

[DCA-2011-0016] - Tufin SecureTrack Cross Site Script

2012-04-0900:00:00
vulners.com
36

[Discussion]

  • DcLabs Security Research Group advises about the following vulnerability(ies):

[Software]

  • Tufin SecureTrack

[Vendor Product Description]

  • Features powerful tools to track changes, analyze device
    configurations, optimize rule bases, and more on leading vendor
    firewalls, routers, switches and network devices. Maintains a
    continuous audit trail for accurate accountability and provides
    built-in reports such as PCI DSS to comply with standards and reduce
    audit preparation time by 50%.

  • Site: http://www.tufin.com

[Advisory Timeline]

  • 12/02/2011 -> First Contact requesting security department contact;

  • 12/02/2011 -> Vendor reply

  • 12/05/2011 -> New Contatc

  • 12/09/2011 -> Advisory sent to Vendor

  • 12/09/2011 -> Coordinate to disclosure

  • 03/15/2012 -> Bug Fixed

  • 04/04/2012 -> Public disclosure

[Bug Summary]

  • Persistent/Stored Cross-Site Scripting (XSS) (A common user can
    launch Xss attack using the any fields (First Name,Last Name and
    others). This Xss is executed in any other logged user context,
    included admin)

  • Non-Persistent Cross-Site Scripting (XSS) - Must a valid session.

[Impact]

  • Medium

[Affected Version]

  • 6.1 build 20596

[Not Affected Version]

6.1 HF10, build 22595

[Bug Description and Proof of Concept]

  • Exploiting the HTML-injection issue allows an attacker to execute
    HTML and Java Script code in the remote user context to steal
    cookie-based authentication credentials or to control how the site is
    rendered to the user; other attacks may also be possible.

  • Moreover, Cross Site Scripting (XSS) vulnerabilities are caused due
    to lack of input validation. This allows malicious people to inject
    arbitrary HTML and script code. More info at:
    http://en.wikipedia.org/wiki/Cross-site_scripting

All flaws described here were discovered and researched by:

Ewerson Guimaraes aka Crash

DcLabs Security Research Group
crash (at) dclabs <dot> com <dot> br

[Patch(s) / Workaround]

Update to 6.1 HF10, build 22595

[Greetz]
DcLabs Security Research Group.


Ewerson Guimaraes (Crash)
Pentester/Researcher
DcLabs Security Team
www.dclabs.com.br