CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS
Percentile
74.3%
The web management interface for the APC Network Monitoring Card (NMC) used in various APC devices contains cross-site scripting (XSS) and cross-site request forgery (CSRF/XSRF) vulnerabilities. By convincing a victim to load a specially crafted URL while authenticated to an NMC, an attacker could obtain credentials or perform certain actions as the victim, including turning off the NMC-based device and any systems attached to it.
Some APC uninterruptible power supplies (UPS) support remote network management using several types of Network Monitoring Card (NMC).
The NMC web management interface does not adequately filter user-supplied data before that data is included in dynamically generated web pages, creating cross-site scripting (XSS) vulnerabilities. One XSS vulnerability occurs in the /Forms/login1?login_username
field (CVE-2009-4406). There may be other XSS vulnerabilities in the NMC web management interface (CVE-2009-1798).
The web interface also fails to adequately authenticate some requests, creating cross-site request forgery (CSRF/XSRF) vulnerabilities (CVE-2009-1797).
By convincing a victim to load a specially crafted URL while authenticated to an NMC, an attacker could obtain user credentials or perform certain actions as that user. It is possible to exploit the XSS vulnerabilities to obtain cookies and other page content, so an attacker could obtain administrative credentials. If the attacker were able to access the NMC directly, the attacker would have complete control and could reconfigure the UPS or turn it off, thereby turning off any systems connected to the UPS. Exploiting the CSRF vulnerabilities could allow an attacker to take certain actions via the web interface, including turning off the UPS and any connected systems.
Update firmware
Update NMC firmware as specified by APC. Release notes indicate that these vulnerabilities are addressed in firmware version 3.7.2 for certain NMCs. APC has indicated that the vulnerabilities are also addressed in firmware version 5.1.1.
Disable web interface
Disabling the web management interface will prevent exploitation of these vulnerabilities.
Restrict access
As a general good security practice, only allow connections from trusted hosts and networks. Consider setting up management networks as separate and dedicated channels. Note that restricting access does not prevent XSS or CSRF attacks since the attack comes as an HTTP request from a legitimate user’s host. Restricting access would prevent an attacker from accessing an NMC using stolen credentials from a blocked network location.
166739
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: February 24, 2010
Statement Date: December 23, 2009
Affected
Please see Cross Site Scripting & Forgery Issue (XSS/CSRF) in NMC-Based Products.
Update NMC firmware as specified by APC. Release notes indicate that these vulnerabilities are addressed in firmware version 3.7.2 for certain NMCs. APC has indicated that the vulnerabilities are also addressed in firmware version 5.1.1.
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
These vulnerabilities were researched and reported by Russ McRee. Jamal Pecou also reported CVE-2009-4406.
This document was written by Art Manion.
CVE IDs: | CVE-2009-1797, CVE-2009-1798, CVE-2009-4406 |
---|---|
Date Public: | 2009-12-14 Date First Published: |
holisticinfosec.org/content/view/111/45/
nam-en.apc.com/cgi-bin/nam_en.cfg/php/enduser/std_adp.php?p_faqid=10887&p_created=1261587018&p_topview=1
www.apcmedia.com/salestools/PMAR-82BMH5_R0_EN.zip
www.securityfocus.com/archive/1/508468/100/0/threaded
www.securityfocus.com/archive/1/508468/30/60/threaded
www.securityfocus.com/bid/37338/info