[DCA-2011-0016] - Tufin SecureTrack Cross Site Script

2012-04-09T00:00:00
ID SECURITYVULNS:DOC:27901
Type securityvulns
Reporter Securityvulns
Modified 2012-04-09T00:00:00

Description

[Discussion]

  • DcLabs Security Research Group advises about the following vulnerability(ies):

[Software]

  • Tufin SecureTrack

[Vendor Product Description]

  • Features powerful tools to track changes, analyze device configurations, optimize rule bases, and more on leading vendor firewalls, routers, switches and network devices. Maintains a continuous audit trail for accurate accountability and provides built-in reports such as PCI DSS to comply with standards and reduce audit preparation time by 50%.

  • Site: http://www.tufin.com

[Advisory Timeline]

  • 12/02/2011 -> First Contact requesting security department contact;
  • 12/02/2011 -> Vendor reply

  • 12/05/2011 -> New Contatc

  • 12/09/2011 -> Advisory sent to Vendor
  • 12/09/2011 -> Coordinate to disclosure
  • 03/15/2012 -> Bug Fixed

  • 04/04/2012 -> Public disclosure

[Bug Summary]

  • Persistent/Stored Cross-Site Scripting (XSS) (A common user can launch Xss attack using the any fields (First Name,Last Name and others). This Xss is executed in any other logged user context, included admin)

  • Non-Persistent Cross-Site Scripting (XSS) - Must a valid session.

[Impact]

  • Medium

[Affected Version]

  • 6.1 build 20596

[Not Affected Version]

6.1 HF10, build 22595

[Bug Description and Proof of Concept]

  • Exploiting the HTML-injection issue allows an attacker to execute HTML and Java Script code in the remote user context to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks may also be possible.

  • Moreover, Cross Site Scripting (XSS) vulnerabilities are caused due to lack of input validation. This allows malicious people to inject arbitrary HTML and script code. More info at: http://en.wikipedia.org/wiki/Cross-site_scripting

All flaws described here were discovered and researched by:

Ewerson Guimaraes aka Crash

DcLabs Security Research Group crash (at) dclabs <dot> com <dot> br

[Patch(s) / Workaround]

Update to 6.1 HF10, build 22595

[Greetz] DcLabs Security Research Group.

-- Ewerson Guimaraes (Crash) Pentester/Researcher DcLabs Security Team www.dclabs.com.br