DELL SonicWALL Universal Management Suite 7.1 Cross Site Scripting

` I. VULNERABILITY  
  
-------------------------  
  
Reflected XSS Attacks vulnerabilities in DELL SonicWALL Universal  
Management Suite v7.1  
  
  
  
II. BACKGROUND  
  
-------------------------  
  
Dell(R) SonicWALL(R) provides intelligent network security and data  
protection solutions that enable customers and partners to dynamically  
secure, control, and scale their global networks.  
  
  
  
III. DESCRIPTION  
  
-------------------------  
  
Has been detected a Reflected XSS vulnerability in DELL SonicWALL  
Universal Management Suite.  
  
The code injection is done through the parameter "node_id " in the  
page "/sgms/mainPage?page=genNetwork&screenid=1002&manager=ScreenDisplayManager&level=1&node_id"  
  
  
  
IV. PROOF OF CONCEPT  
  
-------------------------  
  
The application does not validate the parameter "node_id" correctly.  
  
  
  
https://ip_gms/sgms/mainPage?page=genNetwork&screenid=1002&manager=ScreenDisplayManager&level=1&node_id=aaaaa"><script>alert(document.cookie);</script>&screenid=1002&unused=&help_url=&node_name=Instance  
View&unitType=1&searchBySonicwall=0  
  
  
  
  
V. BUSINESS IMPACT  
  
-------------------------  
  
An attacker can execute arbitrary HTML or script code in a targeted  
  
user's browser, , that allows the execution of arbitrary HTML/script  
code to be executed in the context of the victim user's browser  
allowing Cookie Theft/Session Hijacking, thus enabling full access the  
box.  
  
  
  
  
  
  
  
  
  
  
  
VI. SYSTEMS AFFECTED  
  
-------------------------  
  
Tested DELL SonicWALL Universal Management Suite v7.1 DEMO ONLINE  
  
  
  
  
  
VII. SOLUTION  
  
-------------------------  
  
All data received by the application and can be modified by the user,  
  
before making any kind of transaction with them must be validated  
  
  
  
VII. REFERENCES  
-------------------------  
http://www.kb.cert.org/vuls/id/727318  
http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_XSS_Resolved_in_7.1_SP2_and_7.2.pdf  
  
  
By William Costa  
  
[email protected]  
`