Qiata FTA 1.70.19 Cross Site Scripting

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512  
  
Advisory ID: SYSS-2020-024  
Product: Qiata FTA  
Manufacturer: Secudos GmbH  
Affected Version(s): <= Qiata FTA 1.70.19  
Tested Version(s): Qiata FTA 1.70.19  
Vulnerability Type: Cross-Site Scripting (CWE-79)  
Risk Level: Medium  
Solution Status: Solved  
Manufacturer Notification: 2020-06-17  
Solution Date: 2020-08-12  
Public Disclosure: 2020-09-28  
CVE Reference: CVE-2020-14294  
Author of Advisory: Patrick Hener, SySS GmbH  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Overview:  
  
Qiata FTA is a secure file transfer appliance.  
  
The manufacturer describes the product as follows (see [1]):  
  
"Qiata File Transfer Appliances (FTAs) provide the ability to easily and  
securely exchange files with internal or external users."  
  
Due to insufficient input validation of user-provided input, it is  
vulnerable  
to cross-site scripting.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Vulnerability Details:  
  
Within every transfer initiated, both the sender and the receiver of the  
transfer are able to communicate via a comment function.  
  
This comment function does in fact alter user input and change appearances  
of the special characters '<' and '>' by flipping the direction of the  
special  
character. Also, quotation marks are escaped properly.  
  
An attacker can use the behavior to construct a malicious string, which will  
embed persistent cross-site scripting within the transfer comments. The  
exploit will be executed when viewing the transfer comments.  
  
For a user not registered within the file transfer appliance, the  
exploit will  
be executed directly when opening the provided transfer URL.  
  
This vulnerability is also discovered at the global notice board where  
no escaping could be identified.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Proof of Concept (PoC):  
  
The following string will result in persistent cross-site scripting  
displaying the message "Persistent XSS by SySS GmbH" when executed. All an  
attacker needs to do is to enter the malicious string as a comment to a  
transfer.  
  
">img src=x  
onerror=alert(String.fromCharCode(80,101,114,115,105,115,116,101,  
110,116,32,88,83,83,32,98,121,32,83,121,83,83,32,71,109,98,72)) /<"  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Solution:  
  
The vulnerability was fixed with version Qiata FTA 2.00.00. Update to at  
least this version.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclosure Timeline:  
  
2020-06-02: Vulnerability discovered  
2020-06-17: Vulnerability reported to manufacturer  
2020-08-12: Patch released by manufacturer  
2020-09-28: Public disclosure of vulnerability  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
References:  
  
[1] Product Website for Qiata FTA  
https://www.secudos.de/en/products/qiata-file-transfer  
[2] SySS Security Advisory SYSS-2020-024  
  
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-024.txt  
[3] SySS Responsible Disclosure Policy  
https://www.syss.de/en/news/responsible-disclosure-policy/  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Credits:  
  
This security vulnerability was found by Patrick Hener of SySS  
GmbH.  
  
E-Mail: [email protected]  
Public Key:  
https://www.syss.de/fileadmin/dokumente/PGPKeys/Patrick_Hener.asc  
Key ID: 5C708555930AA477  
Key Fingerprint: 9CB7 1E87 BD83 64B7 38F2 3434 5C70 8555 930A A477  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclaimer:  
  
The information provided in this security advisory is provided "as is"  
and without warranty of any kind. Details of this security advisory may  
be updated in order to provide as accurate information as possible. The  
latest version of this security advisory is available on the SySS website.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Copyright:  
  
Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en  
  
-----BEGIN PGP SIGNATURE-----  
  
iQIzBAEBCgAdFiEEnLceh72DZLc48jQ0XHCFVZMKpHcFAl9x+BAACgkQXHCFVZMK  
pHf6GQ/+OrFPbyLseRztdPeHW0F1c25yj6KNn50KFGZ7AvHmE+o3Cv/A071UpdjA  
OSanp572MAiPNCsKX5C0c9vZr1B6nCMfNRE86qvusYDzVp8tE0/x2H7plXZmQrJ5  
8w44vNWKGapkYarxhvYwRa6EQ3Hc6UZvgt86KzulYJKXj71sHb9mzmJQstfl3Fa/  
bCinLbT1qcSkrQx9gSw/u5CdRCTR1ZykBIXGKnegsiuw3E3bsGWXd+qRggbk/Er4  
upw2aONZ8wZbvs6+gtLcVA9ZaDOmTyNRV3wMfMRtny+EZhZoqErSD1gd2fbyDcEl  
IigI/9kd4SDwgxkyq5oZTCEcB8CB9Ealm31kYjhKBb1m2pn9dmr6SLDgXkI8ykcE  
n4P57utS2Xl++hqBrXvn+Su/qFkQJby7uT14KkUR9y3WezLjwp42E3tH7o+qhNig  
1+bjeGC2aiy3BEULEK51CuVQFYRREZ7AkkeUfzfZvFiIAelWVa5tN0f+sPUfGZwl  
JI+VfsrhRHP05BTK5DQMUv+Am3Xk6Mh+NgRgGWqgLbb5XNvjttYx4/SXDO4xMpcz  
7NKdy9QIo9tzRTa0RDtzhBgR5wmyMcjdkZ7PX8MiPfgEgljF03qK51gL2vCv7t6H  
Gb8IwpJmyZUxov7kGJe6mzyLA7UqkXC5YMTXKYotXjqpbzCuUro=  
=329f  
-----END PGP SIGNATURE-----  
  
  
`