ZENWorks Mobile Management 3.1.0 Cross Site Scripting

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512  
  
Advisory ID: SYSS-2015-020  
Product(s): ZENWorks Mobile Management  
Vendor: Novell  
Affected Version(s): 3.1.0  
Tested Version(s): 3.1.0  
Vulnerability Type: Cross-Site Scripting (CWE-79)  
Risk Level: Medium  
Solution Status: Open  
Vendor Notification: 2015-04-21  
Solution Date:   
Public Disclosure: 2015-06-12  
CVE Reference: Not yet assigned  
Author of Advisory: Ludwig Stage (SySS GmbH)  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Overview:  
  
ZENWorks Mobile Management is a mobile device management software by  
Novell supporting different kinds of mobile devices.  
  
The vendor Novell describes the product as follows (see [1]):  
  
"Novell ZENworks Mobile Management is a product that allows customers   
to manage and secure the full lifecycle of their mobile device  
workforce, from one web services console, using similar concepts that  
ZENworks customers have come to appreciate; ie, users, policies, and   
mobile apps."  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Vulnerability Details:  
  
The SySS GmbH found several reflected cross-site scripting   
vulnerabilities in the web application component of the Novell ZENWorks   
Mobile Management solution which can be exploited from different   
attacker's perspectives.  
  
1) Reflected Cross-Site Scripting in login form  
  
The parameters "username" and "domain" are not sanitized sufficiently  
resulting in a reflected cross-site scripting vulnerability.  
  
This reflected cross-site scripting vulnerability can be exploited in   
the context of an unauthenticated user by sending a specially crafted  
HTTP POST or HTTP GET request (see PoC section).  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Proof of Concept (PoC):  
  
1.1) Reflected Cross-Site Scripting in login form using HTTP POST  
  
The following HTTP POST request using the JavaScript code  
"onfocus="alert(1) as the value for the parameter "username" demonstrates  
the reflected cross-site scripting vulnerability by showing a JavaScript   
alert box:  
  
POST /index.php HTTP/1.1  
Host: <HOST>  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 29  
  
username="onfocus%3d"alert(1)  
  
  
1.2) Reflected Cross-Site Scripting in login form using HTTP GET  
  
The following HTTP GET requests using the JavaScript code  
"onfocus="alert(1) as the value for the URL parameter "username"  
demonstrate the two reflected cross-site scripting vulnerabilities  
by showing a JavaScript alert box.  
  
URL: https://<HOST>/index.php?username="onfocus="alert(1)  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Solution:  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclosure Timeline:  
  
2015-04-21: Vulnerability reported to vendor  
2015-04-29: Reported vulnerability again as the vendor did not reply to  
to the first e-mail with the SySS security advisory  
2015-06-02: Reported vulnerability again as the vendor did not reply to  
to the second e-mail with the SySS security advisory  
2015-06-08: Reported vulnerability again as the vendor did not reply to  
to the third e-mail with the SySS security advisory  
2015-06-12: Public release of security advisory according to the SySS  
Responsible Disclosure Policy  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
References:  
  
[1] Product Web Site for Novell ZENWorks Mobile Management  
https://www.novell.com/products/zenworks/mobile-management/  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Credits:  
  
This security vulnerability was found by Ludwig Stage of the SySS GmbH.  
  
E-Mail: ludwig.stage (at) syss.de  
Public Key: https://syss.de/fileadmin/dokumente/Materialien/PGPKeys/Ludwig_Stage.asc  
Key fingerprint = C2FF F40D FC78 791E EF81 20DF 4B57 48C9 53A5 EE5E  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclaimer:  
  
The information provided in this security advisory is provided "as is"   
and without warranty of any kind. Details of this security advisory may   
be updated in order to provide as accurate information as possible. The  
latest version of this security advisory is available on the SySS Web   
site.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Copyright:  
  
Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1  
  
iQIcBAEBCgAGBQJVen7pAAoJEEtXSMlTpe5eNAIQAM4TqMlKZwGtgaVRiclPioBl  
WSTMc2eu3NZl665DkogNgztbWUrsK/HpAiY88v0DN2xakBzOrYL2kFvEx7L0H1oT  
5ob23m8qgPWNK3Lw2O8YN7ZOwJcjiuv5NsLbX2xPTtn3/hFsOee8IXn8o7qG9om4  
/cXTDidiAhfKZIvuuzNGogpn1dm5+2e/dotHwLU8oFLI11unYamSUrFp8Rg3FVj2  
1miwfJFD6ppRVUULannTGdwC4iTf3l78fNXSfNWjgSbm4DKcPf8g+ZrjmpqYn8GW  
M42/NhiF3xZmno1wJCQbaxRAfMB6ensk4KKv9ZFq0TMXWn9EhU+XZBQ97XPwA1nG  
7vKnn4Yn+56BJzI0LmwVu0roDupQv/zbU9yf5S90orQLBwdj4jznx/ar/cOrmEo1  
6gox0PQ/YOOEAi0sjnYvQ0TSnk9NcRn0MTdpA6AZUH+AAmWibBAHlcc6UUFXwYRq  
ZcXG9wAkLprKl/Mm7DRFox7rrmSSl6Eyu7b6HQHagipH6rzY+ddAhZXDYvietSoB  
y3XgiB/VbNlJ86BgnvuBA2Lp2WPCVKyjxAzO48Km+HoFoog0In4oUeGcNUxpIkVW  
HFMX0uflmP7HjTN4tYsQY7K0/1inu0ez1iEFeM86RRBpHxWPzEpD7WjzFHpACa/e  
SV6gj6zmsQqVi8mI9hvx  
=Nmbm  
-----END PGP SIGNATURE-----  
`