Cisco Ironport Cross Site Request Forgery / Cross Site Scripting

Type packetstorm
Reporter Pedro Andujar
Modified 2013-08-26T00:00:00


                                            ` ===============================  
- Advisory -  
Tittle: Cisco IronPort Security Management Appliance - Multiple issues  
Risk: Medium  
Date: 20.May.2013  
Author: Pedro Andujar  
Twitter: @pandujar  
.: [ INTRO ] :.  
The Cisco Security Management Appliance helps to enable flexible management and comprehensive security control   
at the network gateway. Is a central platform for managing all policy, reporting, and auditing information   
for Cisco web and email security appliances.  
Cisco IronPort Security Management Appliance M170 v7.9.1-030 (and probably other products), are prone to several security issues   
as described below;  
.: [ ISSUE #1 }:.  
Name: Reflected Cross Site Scripting  
Severity: Low   
CVE: CVE-2013-3396  
There is a lack of output escaping in the default error 500 page. When a exception occurs in the application, the error  
description contains user unvalidated input from the request:  
** PoC removed as requested by Cisco. **  
.: [ ISSUE #2 }:.  
Name: Stored Cross Site Scripting  
Severity: Medium  
Due to a lack of input validation on job_name, job_type, appliances_options and config_master parameters which are then   
printed unscapped on job_name, old_job_name, job_type, appliance_lists and config_master fields.  
** PoC removed as requested by Cisco. **  
.: [ ISSUE #3 }:.  
Name: CSRF Token is not used  
Severity: Low  
CVE: CVE-2013-3395  
CSRFKey is not used in some areas of the application, which make even easier to exploit Reflected XSS Issues. In the /report area   
of the application, we got no error even when completely removing the parameter CSRFKey;   
** PoC removed as requested by Cisco. **  
.: [ ISSUE #4 }:.  
Name: Lack of password obfuscation  
Severity: Low  
When exporting the configuration file even if you mark the "mask password" option, the SNMPv3 password still appears in cleartext.  
.: [ CHANGELOG ] :.  
* 20/May/2013: - Vulnerability found.  
* 27/May/2013: - Vendor contacted.  
* 11/Jul/2013: - Public Disclosure  
.: [ SOLUTIONS ] :.  
Thanks to Stefano De Crescenzo (Cisco PSIRT Team), because of his professional way of managing the entire process.  
Stored XSS  
Reflected XSS  
SNMP password issue  
CSCuh27268, CSCuh70314  
.: [ REFERENCES ] :.  
[+] Cisco Content Security Management Appliance M170  
[+] Cisco Security Advisories  
[+] !dSR - Digital Security Research