RSA ACE Agent Image Cross-Site Scripting Vulnerability

Bugtraq ID:	15206
Class:	Input Validation Error
CVE:	CVE-2005-3329
Remote:	Yes
Local:	No
Published:	Oct 26 2005 12:00AM
Updated:	May 09 2007 10:49PM
Credit:	Bernhard Mueller <[email protected]> is credited with the discovery of this vulnerability.
Vulnerable:	Rsa RSA Authentication Agent for Web 5.3 Rsa RSA Authentication Agent for Web 5.2 Rsa RSA Authentication Agent for Web 5.1.1 Rsa RSA Authentication Agent for Web 5.1 Rsa ACE/Agent for Web 5.1.1 Rsa ACE/Agent for Web 5.1
Not Vulnerable:

RSA ACE Agent Image Cross-Site Scripting Vulnerability

RSA ACE Agent is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

RSA ACE Agent Image Cross-Site Scripting Vulnerability

No exploit is required.

The following proof-of-concept URI is available:

http://www.example.com/webauthentication?GetPic?image=x%3Cimg%20src=%22A%22+onError=%22javascript:alert('Thanks%20for%20turning%20on%20the%20remotecontrol')%3b%22%3Exxx

RSA ACE Agent Image Cross-Site Scripting Vulnerability

Solution:
The vendor has released updates to address this issue. Contact the vendor for details on obtaining and applying the appropriate updates.

RSA ACE Agent Image Cross-Site Scripting Vulnerability

References:

• Re: [Full-disclosure] SEC-Consult SA 20051025-1 :: RSA ACE Web Agent XSS (H D Moore )
  
• RSA Authentication Agent Software (RSA)
  
• RSA Homepage (RSA Security)
  
• SEC-Consult SA 20051025-1 :: RSA ACE Web Agent XSS (Bernhard Mueller )