I. VULNERABILITY
-------------------------
Reflected XSS Attacks vulnerabilities in DELL SonicWALL Universal
Management Suite v7.1
II. BACKGROUND
-------------------------
Dell(R) SonicWALL(R) provides intelligent network security and data
protection solutions that enable customers and partners to dynamically
secure, control, and scale their global networks.
III. DESCRIPTION
-------------------------
Has been detected a Reflected XSS vulnerability in DELL SonicWALL
Universal Management Suite.
The code injection is done through the parameter "node_id " in the
page "/sgms/mainPage?page=genNetwork&screenid=1002&manager=ScreenDisplayManager&level=1&node_id"
IV. PROOF OF CONCEPT
-------------------------
The application does not validate the parameter "node_id" correctly.
https://ip_gms/sgms/mainPage?page=genNetwork&screenid=1002&manager=ScreenDisplayManager&level=1&node_id=aaaaa"><script>alert(document.cookie);</script>&screenid=1002&unused=&help_url=&node_name=Instance
View&unitType=1&searchBySonicwall=0
V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted
user's browser, , that allows the execution of arbitrary HTML/script
code to be executed in the context of the victim user's browser
allowing Cookie Theft/Session Hijacking, thus enabling full access the
box.
VI. SYSTEMS AFFECTED
-------------------------
Tested DELL SonicWALL Universal Management Suite v7.1 DEMO ONLINE
VII. SOLUTION
-------------------------
All data received by the application and can be modified by the user,
before making any kind of transaction with them must be validated
VII. REFERENCES
-------------------------
http://www.kb.cert.org/vuls/id/727318
http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf
By William Costa
william.costa@gmail.com
-------------------------
Reflected XSS Attacks vulnerabilities in DELL SonicWALL Universal
Management Suite v7.1
II. BACKGROUND
-------------------------
Dell(R) SonicWALL(R) provides intelligent network security and data
protection solutions that enable customers and partners to dynamically
secure, control, and scale their global networks.
III. DESCRIPTION
-------------------------
Has been detected a Reflected XSS vulnerability in DELL SonicWALL
Universal Management Suite.
The code injection is done through the parameter "node_id " in the
page "/sgms/mainPage?page=genNetwork&screenid=1002&manager=ScreenDisplayManager&level=1&node_id"
IV. PROOF OF CONCEPT
-------------------------
The application does not validate the parameter "node_id" correctly.
https://ip_gms/sgms/mainPage?page=genNetwork&screenid=1002&manager=ScreenDisplayManager&level=1&node_id=aaaaa"><script>alert(document.cookie);</script>&screenid=1002&unused=&help_url=&node_name=Instance
View&unitType=1&searchBySonicwall=0
V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted
user's browser, , that allows the execution of arbitrary HTML/script
code to be executed in the context of the victim user's browser
allowing Cookie Theft/Session Hijacking, thus enabling full access the
box.
VI. SYSTEMS AFFECTED
-------------------------
Tested DELL SonicWALL Universal Management Suite v7.1 DEMO ONLINE
VII. SOLUTION
-------------------------
All data received by the application and can be modified by the user,
before making any kind of transaction with them must be validated
VII. REFERENCES
-------------------------
http://www.kb.cert.org/vuls/id/727318
http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf
By William Costa
william.costa@gmail.com