Lansweeper 6.0.0.63 Cross Site Scripting

`=============================================  
- Release date: October 05th, 2017  
- Discovered by: Giovanni Cerrato, Giovanni Guido and BackBox team  
  
- Severity: Medium  
=============================================  
  
I. VULNERABILITY  
-------------------------  
  
Lansweeper XSS vulnerability.  
  
  
II. INTRODUCTION  
-------------------------  
  
Lansweeper an Asset Management and Network Inventory Tool (v6.0.0.63 and  
probably all previous versions) is affected by a Xss vulnerability.  
  
  
III. DESCRIPTION  
-------------------------  
  
1) REFLECTED CROSS SITE SCRIPTING  
  
The application is affected by Cross Site Scripting vulnerabilities. An  
attacker can use this vulnerability to construct a request that, if issued  
by another application user, will cause JavaScript code supplied by the  
attacker to execute within the useras browser in the context of that useras  
session with the application. The attacker-supplied code can perform a wide  
variety of actions, such as stealing the victimas session token or login  
credentials, performing arbitrary actions on the victimas behalf, and  
logging their keystrokes. Reference:  
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)  
  
  
A* URL: hostname/GlobalActions.aspx?action=getthumbnail  
A* Vulnerable parameters: username, userdomain, upn  
A* Method: POST  
  
  
POC (proof of concept)  
  
The vulnerability can be trigged via a POST request as shown in the  
following PoC's.  
  
Payload username parameter:  
POST /GlobalActions.aspx?action=getthumbnail HTTP/1.1  
type=1&id=-2&size=75&username=<script>alert(1)</script>&userdomain=&upn=  
  
Payload userdomain parameter:  
POST /GlobalActions.aspx?action=getthumbnail HTTP/1.1  
type=1&id=-2&size=75&username=test&userdomain=<script>alert(1)</script>&upn=  
  
Payload upn parameter:  
POST /GlobalActions.aspx?action=getthumbnail HTTP/1.1  
type=1&id=-2&size=75&username=test&userdomain=&upn=<script>alert(1)</script>  
  
  
  
IV. BUSINESS IMPACT  
-------------------------  
  
An attacker could perform a wide variety of actions such as stealing the  
victimas session token or login credentials, performing arbitrary actions  
on the victimas behalf, and logging their keystrokes.  
  
  
V. SYSTEMS AFFECTED  
-------------------------  
  
Version 6.0.0.63 is vulnerable (probably all previous versions)  
  
  
VI. SOLUTION  
-------------------------  
  
Upgrade to version 6.0.0.65 or later.  
  
  
VII. REFERENCES  
-------------------------  
  
lansweeper website:  
  
https://www.lansweeper.com/  
https://www.lansweeper.com/changelog.aspx BUG: #542782  
  
  
VIII. CREDITS  
-------------------------  
  
The vulnerability has been discovered by:  
  
Giovanni Cerrato giovanni(dot)cerrato(at)aizoon(dot)it  
Giovanni Guido giovanni(dot)guido(at)aizoon(dot)it  
BackBox team info(at)backbox(dot)org  
  
  
IX. ADVISORY TIMELINE  
-------------------------  
  
April 21th, 2017: Vulnerability identification  
April 21th, 2017: First contact with vendor  
April 26th, 2017: Vendor notified  
April 26th, 2017: Vendor response; investigating  
May 2th, 2017: Vendor says that the vulnerability will be fixed in the new  
version  
May 11th, 2017: Vulnerabilty fixed (Bug 542782). Reference:  
https://www.lansweeper.com/changelog.aspx  
May 23th, 2017: CVE Requested  
May 29th, 2017: CVE received - "CVE-2017-9292"  
September 18th, 2017: Vulnerability published on backbox.org URL:  
https://backbox.org/membership/lansweeper-v6-0-0-63-xss-vulnerability/  
October 04th, 2017: cve updated  
  
  
  
X. LEGAL NOTICES  
-------------------------  
  
The information contained within this advisory is supplied "as-is" with no  
warranties or guarantees of fitness of use or otherwise. We accept no  
responsibility for any damage caused by the use or misuse of this  
information.  
  
  
<http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>  
Mail  
priva di virus. www.avg.com  
<http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>  
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>  
  
  
`