SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Novell ZENworks Vendors:   Novell
Novell ZENworks Mobile Management Input Validation Flaw Permits Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1032576
SecurityTracker URL:  http://securitytracker.com/id/1032576
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jun 12 2015
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Exploit Included:  Yes  
Version(s): 3.1.0
Description:   A vulnerability was reported in Novell ZENworks Mobile Management. A remote user can conduct cross-site scripting attacks.

The login form does not properly filter HTML code from user-supplied input before displaying the input in the 'username' and 'domain' parameters. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Novell ZENworks software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A demonstration exploit URL is provided:

https://[target]/index.php?username="onfocus="alert(1)

The vendor was notified on April 21, 2015 without response.

Ludwig Stage of the SySS GmbH reported this vulnerability.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Novell ZENworks Mobile Management software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.novell.com/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [SYSS-2015-020] ZENWorks Mobile Management - Cross-Site Scripting

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2015-020
Product(s): ZENWorks Mobile Management
Vendor: Novell
Affected Version(s): 3.1.0
Tested Version(s): 3.1.0
Vulnerability Type: Cross-Site Scripting (CWE-79)
Risk Level: Medium
Solution Status: Open
Vendor Notification: 2015-04-21
Solution Date: 
Public Disclosure: 2015-06-12
CVE Reference: Not yet assigned
Author of Advisory: Ludwig Stage (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

ZENWorks Mobile Management is a mobile device management software by
Novell supporting different kinds of mobile devices.

The vendor Novell describes the product as follows (see [1]):

"Novell ZENworks Mobile Management is a product that allows customers 
to manage and secure the full lifecycle of their mobile device
workforce, from one web services console, using similar concepts that
ZENworks customers have come to appreciate; ie, users, policies, and 
mobile apps."

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The SySS GmbH found several reflected cross-site scripting 
vulnerabilities in the web application component of the Novell ZENWorks 
Mobile Management solution which can be exploited from different 
attacker's perspectives.

1) Reflected Cross-Site Scripting in login form

The parameters "username" and "domain" are not sanitized sufficiently
resulting in a reflected cross-site scripting vulnerability.

This reflected cross-site scripting vulnerability can be exploited in 
the context of an unauthenticated user by sending a specially crafted
HTTP POST or HTTP GET request (see PoC section).

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

1.1) Reflected Cross-Site Scripting in login form using HTTP POST

The following HTTP POST request using the JavaScript code
"onfocus="alert(1) as the value for the parameter "username" demonstrates
the reflected cross-site scripting vulnerability by showing a JavaScript 
alert box:

POST /index.php HTTP/1.1
Host: <HOST>
Content-Type: application/x-www-form-urlencoded
Content-Length: 29

username="onfocus%3d"alert(1)


1.2) Reflected Cross-Site Scripting in login form using HTTP GET

The following HTTP GET requests using the JavaScript code
"onfocus="alert(1) as the value for the URL parameter "username"
demonstrate the two reflected cross-site scripting vulnerabilities
by showing a JavaScript alert box.

URL: https://<HOST>/index.php?username="onfocus="alert(1)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2015-04-21: Vulnerability reported to vendor
2015-04-29: Reported vulnerability again as the vendor did not reply to
to the first e-mail with the SySS security advisory
2015-06-02: Reported vulnerability again as the vendor did not reply to
to the second e-mail with the SySS security advisory
2015-06-08: Reported vulnerability again as the vendor did not reply to
to the third e-mail with the SySS security advisory
2015-06-12: Public release of security advisory according to the SySS
Responsible Disclosure Policy
           
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product Web Site for Novell ZENWorks Mobile Management
    https://www.novell.com/products/zenworks/mobile-management/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Ludwig Stage of the SySS GmbH.

E-Mail: ludwig.stage (at) syss.de
Public Key: https://syss.de/fileadmin/dokumente/Materialien/PGPKeys/Ludwig_Stage.asc
Key fingerprint = C2FF F40D FC78 791E EF81 20DF 4B57 48C9 53A5 EE5E

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may 
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web 
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVen7pAAoJEEtXSMlTpe5eNAIQAM4TqMlKZwGtgaVRiclPioBl
WSTMc2eu3NZl665DkogNgztbWUrsK/HpAiY88v0DN2xakBzOrYL2kFvEx7L0H1oT
5ob23m8qgPWNK3Lw2O8YN7ZOwJcjiuv5NsLbX2xPTtn3/hFsOee8IXn8o7qG9om4
/cXTDidiAhfKZIvuuzNGogpn1dm5+2e/dotHwLU8oFLI11unYamSUrFp8Rg3FVj2
1miwfJFD6ppRVUULannTGdwC4iTf3l78fNXSfNWjgSbm4DKcPf8g+ZrjmpqYn8GW
M42/NhiF3xZmno1wJCQbaxRAfMB6ensk4KKv9ZFq0TMXWn9EhU+XZBQ97XPwA1nG
7vKnn4Yn+56BJzI0LmwVu0roDupQv/zbU9yf5S90orQLBwdj4jznx/ar/cOrmEo1
6gox0PQ/YOOEAi0sjnYvQ0TSnk9NcRn0MTdpA6AZUH+AAmWibBAHlcc6UUFXwYRq
ZcXG9wAkLprKl/Mm7DRFox7rrmSSl6Eyu7b6HQHagipH6rzY+ddAhZXDYvietSoB
y3XgiB/VbNlJ86BgnvuBA2Lp2WPCVKyjxAzO48Km+HoFoog0In4oUeGcNUxpIkVW
HFMX0uflmP7HjTN4tYsQY7K0/1inu0ez1iEFeM86RRBpHxWPzEpD7WjzFHpACa/e
SV6gj6zmsQqVi8mI9hvx
=Nmbm
-----END PGP SIGNATURE-----
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC