Full Disclosure mailing list archives
CLOUD4WI SPLASH PORTAL REFLECTED XSS VULNERABILITY – CVE-2015-4699
From: "agotouning () libero it" <agotouning () libero it>
Date: Fri, 11 Dec 2015 10:04:36 +0100 (CET)
CLOUD4WI SPLASH PORTAL Reflected XSS vulnerability Quantum Leap Advisory: CLOUD4WI SPLASH PORTAL Reflected XSS vulnerability – Adivsory # CVE-2015-4699 Affected Product: CLOUD4WI SPLASH PORTAL Credits: Vulnerability discovered by Agostino Parentela of Quantum Leap s.r.lExecutive SummaryUsing a specially crafted HTTP request, it is possible to exploit a lack in the neutralization of the pages output which includes the user submitted content. Successful exploitation of the vulnerabilities, results in the execution of arbitrary HTML and script code in user’s browser in context of the vulnerable web application trough a “Reflected XSS”.Proof of ConceptIt has been discovered a reflected XSS vulnerability on to ControlPanel page in Cloud4wi Splash Portal. Below you can find a proof of concept of the vulnerability: go to “Forgot your credentials?” pageAfter compile form of username and submit the request, the server return a message of error because “Invalid username” with the URL “?recovery=1&recoveryMessage=Invalid%20username”. Here it’s possibile to inject a malicius code.GET /?recovery=1&recoveryMessage=Invalid%20username”);><script>alert(“XSS”);</script> HTTP/1.1 Host: controlpanel.cloud4wi.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Connection: keep-aliveFigure 1 shows the arbitrary code executed in the user browser context.SolutionTo fix the security issue we recommend to update at new version 5.9.7, the vendor has resolved this issue.Disclosure Timeline29/04/2015 – Vulnerability Discovered 08/05/2015 – Initial vendor notification 30/07/2015 – The vendor fixed the vulnerability 04/08/2015 – Public advisoryReferences[1] https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet [2] https://cloud4wi.zendesk.com/hc/en-us/articles/204956829-Cloud4Wi-5-9-7-Release-Note _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- CLOUD4WI SPLASH PORTAL REFLECTED XSS VULNERABILITY – CVE-2015-4699 agotouning () libero it (Dec 11)