WatchGuard Fireware XTM 'poll_name' Parameter Cross Site Scripting Vulnerability
BID:66210
Info
WatchGuard Fireware XTM 'poll_name' Parameter Cross Site Scripting Vulnerability
| Bugtraq ID: | 66210 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-0338 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 13 2014 12:00AM |
| Updated: | Mar 13 2014 12:00AM |
| Credit: | William Costa |
| Vulnerable: |
WatchGuard Fireware XTM 11.8.1 |
| Not Vulnerable: |
WatchGuard Fireware XTM 11.8.3 |
Discussion
WatchGuard Fireware XTM 'poll_name' Parameter Cross Site Scripting Vulnerability
WatchGuard Fireware XTM is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Fireware XTM versions 11.8.1 and prior are vulnerable.
WatchGuard Fireware XTM is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Fireware XTM versions 11.8.1 and prior are vulnerable.
Exploit / POC
WatchGuard Fireware XTM 'poll_name' Parameter Cross Site Scripting Vulnerability
Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
The following example URI is available:
https://www.example.com/firewall/policy?pol_name=qqq";><body onload=alert(document.cookie)>&service=Any&is_new=1
Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
The following example URI is available:
https://www.example.com/firewall/policy?pol_name=qqq";><body onload=alert(document.cookie)>&service=Any&is_new=1