CVE-2014-3809: Reflected XSS in Alcatel Lucent 1830 PSS-32/16/4

2014-12-01T00:00:00
ID SECURITYVULNS:DOC:31472
Type securityvulns
Reporter Securityvulns
Modified 2014-12-01T00:00:00

Description

SWISSCOM CSIRT ADVISORY - http://www.swisscom.com/security

CVE ID: CVE-2014-3809

Product: 1830 Photonic Service Switch PSS-32/16/4

Vendor: Alcatel-Lucent

Subject: Reflected Cross-site Scripting - XSS

Effect: Remotely exploitable

Author: Stephan Rickauer (stephan.rickauer at swisscom.com)

Date: December 1st 2014

Introduction:

Swisscom CSIRT discovered a security flaw in the management interface of the Alcatel Lucent 1830 Photonic Service Switch series.

Vulnerable:

All Switches of Release 6.0 or lower are vulnerable.

Patches:

None.

Description:

The management interface of the 1830 Photonic Switch series is vulnerable to reflected cross-site scripting, since user input is not properly encoded on output. Exploiting this vulnerability will lead to so-called cross-site scripting (XSS) and allows the impersonation of logged-in admin users. Additionally, the myurl-Parameter accepts non-local web addresses, which can be abused to redirect victims to arbitrary web sites.

Attack vector:

https://xx.xx.xx.xx/menu/pop.html?myurl=);<script>alert('xss')</script>

Statement Vendor:

"The vulnerability is assessed at no risk. We will evaluate if/when we will add the best practice of validating all inputs in WebUI tasks, but this is not considered high priority for the roadmap."

Milestones:

May 21st 2014 Vulnerability discovered May 21st 2014 CVE requested June 13th 2014 Vendor contact established and provided with technical details June 16th 2014 Vendor acknowledged issue (Psirt.Security at alcatel-lucent.com) Aug. 28th 2014 Vendor update requested Okt. 1st 2014 Vendor update requested Dec. 1st 2014 Vendor update requested Dec. 1st 2014 Vendor assess XSS not to be an issue Dec. 1st 2014 Public release of advisory