Zoho OpManager Cross Site Request Forgery / Cross Site Scripting

`Reported these 27/08/2015 these were eventually fixed in version 12 because the entire application is based on emberjs now. There are no CVEs for these issues assigned nor is there any acknowledgement of the issues in any patches. Therefore only version 12 fixes these.  
  
Multiple stored and reflected XSS as well as CSRF. There are also multiple issues related to content-type and one related to overwriting local files that wasn't reported and passwords being disclosed. Basically prior to version 12 opmanager is riddled with security issues  
  
The following are stored XSS:  
/admin/ConfigURLMonitor.do [fieldname]  
/admin/MaintenanceTask.do [selectedAvailableDevices]  
/admin/MaintenanceTask.do [selectedDevicesToMove]  
/admin/ScheduleMgmt.do [repName]  
/api/json/admin/getSysLogForwarders [destHost]  
/api/json/device/getDeviceSummary [clName]  
/api/json/reports/getReportsList [repName]  
/devices/AddNewCF.do [fieldname]  
/devices/DeviceCustomFields.do [fieldname]  
/devices/manageUnmanage.do [fieldname]  
/devices/manageUnmanage.do [fieldname]  
/reports/ReportsIndex.do [repName]  
/reports/ReportsIndex.do [repName]  
  
The following are reflected XSS attacks  
/admin/AddDeviceTypeForm.do [oid]  
/admin/AddDeviceTypeForm.do [operationmode]  
/admin/ConfigURLMonitor.do [ipAddress]  
/admin/DependencyList.do [selectedTab]  
/admin/DependencyList.do [selectedTab]  
/admin/DeviceAssociation.do [selectedTab]  
/admin/EditDeviceGraph.do [operation]  
/admin/InvokeDeviceType.do [PAGE_NUMBER]  
/admin/MaintenanceTask.do [selectedAvailableDevices]  
/admin/MaintenanceTask.do [selectedDevicesToMove]  
/admin/MaintenanceTask.do [taskID]  
/admin/MibTool.do [selectedmib]  
/admin/SNMPTrapProcessors.do [PAGE_NUMBER]  
/admin/SNMPTrapProcessors.do [PAGE_NUMBER]  
/admin/SNMPTrapProcessors.do [operation]  
/admin/SNMPTrapProcessors.do [operation]  
/admin/SNMPTrapProcessors.do [operation]  
/admin/SNMPTrapProcessors.do [operation]  
/admin/ServiceConfiguration.do [operation]  
/admin/ServiceConfiguration.do [operation]  
/admin/ServiceConfiguration.do [operation]  
/admin/SetupSDesk.do [AutoSync]  
/admin/SetupSDesk.do [Merge]  
/admin/SetupSDesk.do [ticketType]  
/admin/SysLogRules.do [SysLogPort]  
/admin/SysLogRules.do [SysLogPort]  
/admin/SysLogRules.do [status]  
/admin/TrapConfiguration.do [PAGE_NUMBER]  
/admin/TrapConfiguration.do [status]  
/admin/ViewFailoverDetails.do [endDate]  
/admin/ViewFailoverDetails.do [endDate]  
/admin/ViewFailoverDetails.do [endHour]  
/admin/ViewFailoverDetails.do [endHour]  
/admin/ViewFailoverDetails.do [startDate]  
/admin/ViewFailoverDetails.do [startDate]  
/admin/ViewFailoverDetails.do [startHour]  
/admin/ViewFailoverDetails.do [startHour]  
/admin/ViewFailoverDetails.do [viewLength]  
/customDashboard.do [dashboardName]  
/devices/AddNewCF.do [fieldname]  
/devices/AddNewCF.do [type]  
/devices/CustomLinks.do [name]  
/devices/DeviceCustomFields.do [type]  
/devices/Search.do [searchTerm]  
/devices/deviceinfo.do [devicename]  
/devices/graphview.do [name]  
/devices/manageUnmanage.do [displayName]  
/devices/manageUnmanage.do [ipAddress]  
/devices/objectdetails.do [displayName]  
/devices/objectdetails.do [ipAddress]  
/devices/updateStatus.do [displayName]  
/devices/updateStatus.do [ipAddress]  
/fault/AlarmView.do [displayName]  
/map/AddFileMonitor.do [devicename]  
/map/AddFileMonitor.do [displayName]  
/map/AddFileMonitor.do [ipAddress]  
/map/AddNotification.do [devicename]  
/map/AddNotification.do [displayName]  
/map/AddNotification.do [ipAddress]  
/map/AddProcesses.do [deviceName]  
/map/AddProcesses.do [displayName]  
/map/AddProcesses.do [ipAddress]  
/map/AddServices.do [devicename]  
/map/AddServices.do [devicename]  
/map/AddServices.do [devicename]  
/map/EditMap.do [source]  
/map/FileMonitorTemplates.do [devicename]  
/map/FileMonitorTemplates.do [monitorType]  
/map/InvokeDeviceType.do [devicename]  
/map/InvokeDeviceType.do [devicename]  
/map/InvokeDeviceType.do [devicename]  
/map/InvokeMonitoring.do [devicename]  
/map/InvokeMonitoring.do [devicename]  
/map/MapView.do [displayName]  
/map/SnpUpdateServices.do [displayName]  
/map/SnpUpdateServices.do [ipAddress]  
/map/UpdateDeviceType.do [devicename]  
/modifyDashboard.do [dashboardName]  
/reports/Availability.do [bview]  
/reports/Availability.do [reportGroup]  
/reports/Availability.do [reportGroup]  
/reports/Availability.do [reportGroup]  
/reports/Availability.do [reportGroup]  
/reports/Availability.do [reportGroup]  
/reports/Availability.do [viewCount]  
/reports/NewReport.do [repName]  
/reports/NewReport.do [repName]  
/reports/NewReport.do [repName]  
/reports/NewReport.do [repName]  
/reports/deviceAvailability.do [deviceName]  
/reports/deviceAvailability.do [deviceName]  
/reports/deviceAvailability.do [deviceName]  
/reports/deviceAvailability.do [deviceName]  
/webclient/admin/jsp/DeviceQuery.jsp [oidtext]  
  
  
Vulnerable to CSRF:  
/SavePreferences.do  
/TabMenu.do  
/admin/AddCriteria.do  
/admin/AddIPSLAMonitor.do  
/admin/BenchmarkDataUpload.do  
/admin/BulkDeviceAssociation.do  
/admin/BulkEditDeviceGraph.do  
/admin/CategoryOperation.do  
/admin/ConfigureProfile.do  
/admin/DBManagement.do  
/admin/DependencyList.do  
/admin/DeviceAssociation.do  
/admin/EditInterfaceTemplates.do  
/admin/EditInterfaceTemplates1.do  
/admin/ImportWorkflow.do  
/admin/MaintenanceTask.do  
/admin/RebrandOPM.do  
/admin/SNMPTrapProcessors.do  
/admin/SaveInterfaceTemplates.do  
/admin/ScheduleMgmt.do  
/admin/ScriptMonitor.do  
/admin/ScriptTemplateImport.do  
/admin/SelectQCW.do  
/admin/ServiceConfiguration.do  
/admin/SetupSDesk.do  
/admin/ShareTemplate.do  
/admin/SysLogNotification.do  
/admin/SysLogRules.do  
/admin/TrapNotification.do  
/admin/UpdateAlarmEscalation.do  
/admin/ViewFailoverDetails.do\  
/cctvConfig.do  
/devices/AddFromCSV.do  
/devices/CustomLinks.do  
/devices/switchPortMapTool.do  
/map/L2Map.do  
/map/SnmpDetails.do  
/reports/AuditReport.do  
/reports/GenerateReports.do  
/reports/SelectDevice.do  
/reports/deviceAvailability.do  
/topo/addNewNetwork.do  
  
Additionally  
  
GET /api/json/device/getDeviceSummary?name=localhost&apiKey=aaaa&_bbbb  
  
:false,"deviceName":"localhost","sysDescr":"","isNetwork":false,"responseTime":"001ms","ipAddress":"127.0.0.1","ramSize":"NA","vendorName":"Unknown","pollUsing":"ICMP","status":"L..schen","community":"public","dnsName":"localhost","availdata":{"Down":0,"Not  
Monitored":0,"Up":100,"Parent Down":0,"Dependent Unavailable":0,"On  
Hold":0,"On Maintenance":0},"customLinks":[],"isvCenter":false,"isSNMP":false,"snm  
  
This returns the community password for SNMP devices. This can allows someone malicious on the panel or via XSS collect SNMP passwords.  
`