About the product:
Palo Alto Traps is an advanced endpoint protection suite that detects attacks such as memory corruption, executable child processes, DLL hijacking, etc. Aside from optionally blocking it, it sends this βtrapβ to a central server for logging purposes.
About the vulnerability:
An attacker can send a SOAP request with JavaScript embedded inside it, which gets stored in the database. When an administrator monitors the Trapsβ admin screen and opens details about the vulnerability, the JavaScript is executed on the admin browser.
The XSS works in the <b:Arguments>, <b:FileName> and <b:URL> parameters, for example:
<b:Arguments>"C:\\Users\\Michael\\fake.exe"
<script>
alert("xss");
</script>
</b:Arguments>
A POC script can be found at the following URL:
https://github.com/ndrix/random-scripts/blob/master/pa_traps_xss.rb
Solution:
The vendor was notified back in October 2014, and a weβve sent a few follow ups since. Contact the vendor for the patch details.
References: