TC-SA-2011-02: Multiple web-vulnerabilities in iTop version 1.1.181
Published: 2011/11/16 Version 1.0
Affected products: iTop version 1.1.181, 1.2.0-RC-282 (maybe earlier versions as well) http://sourceforge.net/projects/itop/
References: CVE-2011-4275 - Multiple web-vulnerabilities in iTop TC-SA-2011-02 www.tele-consulting.com/advisories/TC-SA-2011-02.txt (used for updates)
Summary: "IT Operations Portal: a complete open source, ITIL, web based service management tool including a fully customizable CMDB, a helpdesk system and a document management tool." Several common flaws could be found in iTop like reflected and stored XSS.
reflected XSS: - almost every test input field where the value is reflected in
Examples: stored XSS: - add a company named "XSS <script>alert("Help Me")</script>" - add a database server named "XSS <script>alert("Help Me")</script>" - import a CSV-File where one cell contains "XSS <script>alert("Help Me")</script>" - copy&paste data (which does the same as CSV-import) using 1;Test 1 2;Test 2 3;Test 3<script>alert("23746234243 Test")</script>"
reflected XSS (un-authenticated):
reflected XSS (authenticated):
http://$domain/iTop/pages/UI.php?c%5bmenu%5d=60&class=Note¤tId=Searc hFormToAdd_document_list \ &description="<script>alert("Help Me")</script>"&dosearch=1&name=Acunetix&open=1&operation=search \ _form&org_id=3&status=draft&type=contract
Possible solutions: - use version 1.2 final
Disclosure Timeline: 2011/08/09 vendor contacted via firstname.lastname@example.org 2011/08/09 inital vendor response 2011/09/06 first patch by the vendor 2011/09/12 second patch by the vendor 2011/11/16 public disclosure
Credits: Tobias Glemser (email@example.com) Tele-Consulting security networking training GmbH, Germany www.tele-consulting.com
Disclaimer: All information is provided without warranty. The intent is to provide information to secure infrastructure and/or systems, not to be able to attack or damage. Therefore Tele-Consulting shall not be liable for any direct or indirect damages that might be caused by using this information.