Cisco IronPort Security Management Appliance Multiple issues

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1044529 漏洞类型
发布时间 2013-08-27 更新时间 2013-08-27
CVE编号 CVE-2013-3396
漏洞平台 N/A CVSS评分 N/A
                   - Advisory -

  Tittle:   Cisco IronPort Security Management Appliance - Multiple issues
    Risk:   Medium
    Date:   20.May.2013
  Author:   Pedro Andujar
 Twitter:   @pandujar

.: [ INTRO ] :.

The Cisco Security Management Appliance helps to enable flexible management and comprehensive security control 
at the network gateway. Is a central platform for managing all policy, reporting, and auditing information 
for Cisco web and email security appliances.


Cisco IronPort Security Management Appliance M170 v7.9.1-030 (and probably other products), are prone to several security issues 
as described below;

.: [ ISSUE #1 }:.

Name: Reflected Cross Site Scripting
Severity: Low 
CVE: CVE-2013-3396

There is a lack of output escaping in the default error 500 page. When a exception occurs in the application, the error
description contains user unvalidated input from the request:

** PoC removed as requested by Cisco. **

.: [ ISSUE #2 }:.

Name: Stored Cross Site Scripting
Severity: Medium

Due to a lack of input validation on job_name, job_type, appliances_options and config_master parameters which are then 
printed unscapped on job_name, old_job_name, job_type, appliance_lists and config_master fields.

** PoC removed as requested by Cisco. **

.: [ ISSUE #3 }:.

Name: CSRF Token is not used
Severity: Low
CVE: CVE-2013-3395

CSRFKey is not used in some areas of the application, which make even easier to exploit Reflected XSS Issues. In the /report area 
of the application, we got no error even when completely removing the parameter CSRFKey; 

** PoC removed as requested by Cisco. **


.: [ ISSUE #4 }:.

Name: Lack of password obfuscation
Severity: Low

When exporting the configuration file even if you mark the "mask password" option, the SNMPv3 password still appears in cleartext.

.: [ CHANGELOG ] :.

  * 20/May/2013:   - Vulnerability found.
  * 27/May/2013:   - Vendor contacted.
  * 11/Jul/2013:   - Public Disclosure

.: [ SOLUTIONS ] :.

Thanks to Stefano De Crescenzo (Cisco PSIRT Team), because of his professional way of managing the entire process.

Stored XSS

Reflected XSS

SNMP password issue
CSCuh27268, CSCuh70314


.: [ REFERENCES ] :.

   [+] Cisco Content Security Management Appliance M170

   [+] Cisco Security Advisories

   [+] !dSR - Digital Security Research