HP System Management Homepage U “proxy/smhui/getuiinfo”跨站脚本攻击漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1180487 漏洞类型 跨站脚本
发布时间 2010-02-03 更新时间 2010-02-04
CVE编号 CVE-2009-4185 CNNVD-ID CNNVD-201002-055
漏洞平台 N/A CVSS评分 4.3
|漏洞来源
https://www.securityfocus.com/bid/38081
https://cxsecurity.com/issue/WLB-2010020164
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201002-055
|漏洞详情
HPSystemManagementHomepage(SMH)的proxy/smhui/getuiinfo中存在跨站脚本攻击漏洞。远程攻击者可以借助servercert参数执行跨站脚本攻击,注入任意web脚本或HTML。
|漏洞EXP
PR09-15: XSS injection vulnerability within HP System Management
Homepage (Insight Manager)

Vulnerability found: 11th October 2009

Severity: Medium

Description:

A XSS vulnerability has been found within HP System Management; Arising from insufficient input filtering. By using a specially-crafted link, and tricking the victim into clicking on it, an attacker can perform malicious attacks such as the following:

- Hijack user accounts by stealing the victim's cookies that are assigned to the victim's browser by the vulnerable website

- Hijack user accounts by injecting a "fake" html form on the html rendered by the victim's web browser

- Redirect the victim to a malicious third-party website which would perform a phishing attack to steal the user credentials or exploit a vulnerability (i.e.: buffer overflow) on the victim's web browser in order to compromise the victim's workstation

Notes:

Authentication is normally needed, unless system has been configured to support anonymous autologin.

Vulnerable Parameter:

- servercert

Successfully tested on:
Version 2.1.15.210
Version v3.0.0.64
Version v3.0.0.68
version v3.0.2.77

Tested on Windows 2008 64bit and Centos/Red Hat enterprise
Hardware Proliant DL380 G5 and DL360 G5

Proof of concept:

http://target-domain.foo/proxy/smhui/getuiinfo?JS&servercert=%0064e43<sc
ript>alert(1)</script>7b3f58a689f

Consequences:

Attackers can force the victim's web browser to perform XSS/HTML injection in the security context of the vulnerable site in order to gather data from users who visit a page within the target site.

Fix:

HP have issued a fix, download the appropiate update for your operating system ensuring the sytem management agent is ay least version 6.0.0.96 or above.

Credits: Richard Brain of ProCheckUp Ltd (www.procheckup.com)

Legal:

Copyright 2009 ProCheckUp Ltd. All rights reserved.

Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if the Bulletin is not changed or edited in any way, is attributed to ProCheckUp indicating this web page URL, and provided such
reproduction and/or distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. ProCheckUp is not
liable for any misuse of this information by any third party. ProCheckUp
is not responsible for the content of external Internet sites.

|受影响的产品
HP System Management Homepage 3.0.2 .77 HP System Management Homepage 3.0.1 .73 HP System Management Homepage 3.0 .68 HP System Management Homepage 3.0 .64 HP System Management Homepage 3.0.
|参考资料

来源:VUPEN
名称:ADV-2010-0294
链接:http://www.vupen.com/english/advisories/2010/0294
来源:BID
名称:38081
链接:http://www.securityfocus.com/bid/38081
来源:BUGTRAQ
名称:20100127PR09-15:XSSinjectionvulnerabilitywithinHPSystemManagementHomepage(InsightManager)
链接:http://www.securityfocus.com/archive/1/archive/1/509195/100/0/threaded
来源:MISC
链接:http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-15
来源:SECUNIA
名称:38341
链接:http://secunia.com/advisories/38341
来源:HP
名称:SSRT090220
链接:http://marc.info/?l=bugtraq&m=126529736830358&w=2
来源:HP
名称:SSRT090220
链接:http://marc.info/?l=bugtraq&m=126529736830358&w=2