ProCheckUp Security Advisory 2009.15

`PR09-15: XSS injection vulnerability within HP System Management  
Homepage (Insight Manager)  
  
Vulnerability found: 11th October 2009  
  
Severity: Medium  
  
Description:  
  
A XSS vulnerability has been found within HP System Management; Arising  
from insufficient input filtering.  
By using a specially-crafted link, and tricking the victim into clicking  
on it, an attacker can perform malicious attacks such as the following:  
  
- Hijack user accounts by stealing the victim's cookies that are  
assigned to the victim's browser by the vulnerable website  
  
- Hijack user accounts by injecting a "fake" html form on the html  
rendered by the victim's web browser  
  
- Redirect the victim to a malicious third-party website which would  
perform a phishing attack to steal the user credentials or exploit a  
vulnerability (i.e.: buffer overflow) on the victim's web browser in  
order to compromise the victim's workstation  
  
Notes:  
  
Authentication is normally needed, unless system has been configured to  
support anonymous autologin.  
  
Vulnerable Parameter:  
  
- servercert  
  
Successfully tested on:  
Version 2.1.15.210  
Version v3.0.0.64  
Version v3.0.0.68  
version v3.0.2.77  
  
Tested on Windows 2008 64bit and Centos/Red Hat enterprise  
Hardware Proliant DL380 G5 and DL360 G5  
  
Proof of concept:  
  
http://target-domain.foo/proxy/smhui/getuiinfo?JS&servercert=%0064e43<script>alert(1)</script>7b3f58a689f  
  
Consequences:  
  
Attackers can force the victim's web browser to perform XSS/HTML  
injection in the security context of the vulnerable site in order to  
gather data from users who visit a page within the target site.  
  
Fix:  
  
HP have issued a fix, download the appropiate update for your operating  
system ensuring the sytem management agent is ay least version 6.0.0.96  
or above.  
  
Credits: Richard Brain of ProCheckUp Ltd (www.procheckup.com)  
  
  
Legal:  
  
Copyright 2009 ProCheckUp Ltd. All rights reserved.  
  
Permission is granted for copying and circulating this Bulletin to the  
Internet community for the purpose of alerting them to problems, if and  
only if the Bulletin is not changed or edited in any way, is attributed  
to ProCheckUp indicating this web page URL, and provided such  
reproduction and/or distribution is performed for non-commercial purposes.  
  
Any other use of this information is prohibited. ProCheckUp is not  
liable for any misuse of this information by any third party. ProCheckUp  
is not responsible for the content of external Internet sites.  
  
`