Информационная безопасность
[RU] switch to English

Дополнительная информация

  Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  XSS vulnerability Adobe Connect 9.3 (CVE-2015-0343 )

  ZCMS SQL Injection & Persistent XSS

  Nakid-CMS CSRF, Persistent XSS & LFI

  [KIS-2015-03] Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability

From:ludwig.stage_(at)_syss.de <ludwig.stage_(at)_syss.de>
Date:14 июня 2015 г.
Subject:[SYSS-2015-020] ZENWorks Mobile Management - Cross-Site Scripting

Hash: SHA512

Advisory ID: SYSS-2015-020
Product(s): ZENWorks Mobile Management
Vendor: Novell
Affected Version(s): 3.1.0
Tested Version(s): 3.1.0
Vulnerability Type: Cross-Site Scripting (CWE-79)
Risk Level: Medium
Solution Status: Open
Vendor Notification: 2015-04-21
Solution Date:
Public Disclosure: 2015-06-12
CVE Reference: Not yet assigned
Author of Advisory: Ludwig Stage (SySS GmbH)



ZENWorks Mobile Management is a mobile device management software by
Novell supporting different kinds of mobile devices.

The vendor Novell describes the product as follows (see [1]):

"Novell ZENworks Mobile Management is a product that allows customers
to manage and secure the full lifecycle of their mobile device
workforce, from one web services console, using similar concepts that
ZENworks customers have come to appreciate; ie, users, policies, and
mobile apps."


Vulnerability Details:

The SySS GmbH found several reflected cross-site scripting
vulnerabilities in the web application component of the Novell ZENWorks
Mobile Management solution which can be exploited from different
attacker's perspectives.

1) Reflected Cross-Site Scripting in login form

The parameters "username" and "domain" are not sanitized sufficiently
resulting in a reflected cross-site scripting vulnerability.

This reflected cross-site scripting vulnerability can be exploited in
the context of an unauthenticated user by sending a specially crafted
HTTP POST or HTTP GET request (see PoC section).


Proof of Concept (PoC):

1.1) Reflected Cross-Site Scripting in login form using HTTP POST

The following HTTP POST request using the JavaScript code
"onfocus="alert(1) as the value for the parameter "username" demonstrates
the reflected cross-site scripting vulnerability by showing a JavaScript
alert box:

POST /index.php HTTP/1.1
Host: <HOST>
Content-Type: application/x-www-form-urlencoded
Content-Length: 29


1.2) Reflected Cross-Site Scripting in login form using HTTP GET

The following HTTP GET requests using the JavaScript code
"onfocus="alert(1) as the value for the URL parameter "username"
demonstrate the two reflected cross-site scripting vulnerabilities
by showing a JavaScript alert box.

URL: https://<HOST>/index.php?username="onfocus="alert(1)




Disclosure Timeline:

2015-04-21: Vulnerability reported to vendor
2015-04-29: Reported vulnerability again as the vendor did not reply to
to the first e-mail with the SySS security advisory
2015-06-02: Reported vulnerability again as the vendor did not reply to
to the second e-mail with the SySS security advisory
2015-06-08: Reported vulnerability again as the vendor did not reply to
to the third e-mail with the SySS security advisory
2015-06-12: Public release of security advisory according to the SySS
Responsible Disclosure Policy


[1] Product Web Site for Novell ZENWorks Mobile Management



This security vulnerability was found by Ludwig Stage of the SySS GmbH.

E-Mail: ludwig.stage (at) syss.de
Public Key: https://syss.de/fileadmin/dokumente/Materialien/PGPKeys/Ludwig_Stage.asc
Key fingerprint = C2FF F40D FC78 791E EF81 20DF 4B57 48C9 53A5 EE5E



The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web



Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en
Version: GnuPG v1


О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород