Juniper SA 2500 VPN SSL - Client Side XSS Vulnerability

Document Title:
===============
Juniper SA 2500 VPN SSL - Client Side XSS Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=723


Release Date:
=============
2013-01-22


Vulnerability Laboratory ID (VL-ID):
====================================
723


Common Vulnerability Scoring System:
====================================
1.5


Product & Service Introduction:
===============================
The Juniper Networks® SA2500, SA4500, and SA6500 SSL VPN Appliances meet the needs
of companies of all sizes. SA Series SSL VPN Appliances use SSL, the security protocol
found in all standard Web browsers. The use of SSL eliminates the need for pre-installed
client software, changes to internal servers, and costly ongoing maintenance and desktop
support. The SA Series also offers sophisticated partner/customer extranet features that
enable controlled access to differentiated users and groups without requiring infrastructure
changes, demilitarized zone (DMZ) deployments, or software agents.

The SA Series includes Juniper Networks Junos® Pulse, a dynamic, integrated, multiservice
network interface for mobile and nonmobile devices. Junos Pulse enables optimized,
accelerated, anytime, anywhere access to corporate networks, clouds, and the data they
hold. Junos Pulse enables secure SSL access from a wide range of mobile and nonmobile
devices, including smartphones, tablets, laptops, and desktop PCs, as well as Wi-Fi or
3G/4G and Long Term Evolution (LTE)-enabled devices. Junos Pulse delivers enterprises
improved productivity and secure, ubiquitous access to corporate applications and data—
anytime, anywhere.

(Copy from vendor website : http://www.juniper.net/us/en/local/pdf/datasheets/1000220-en.pdf)


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered client site cross site scripting vulnerability in Juniper SA2500 VPN SSL appliance application.


Vulnerability Disclosure Timeline:
==================================
2012-10-09:	Researcher Notification & Coordination
2012-10-10:	Vendor Notification
2012-10-12:	Vendor Response/Feedback
2013-01-12:	Vendor Fix/Patch
2012-01-22:	Public Disclosure


Discovery Status:
=================
Published


Affected Product(s):
====================
Juniper
Product: SA2500 VPN SSL 7.1R8 - Build 20737


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Low


Technical Details & Description:
================================
A non-persistent cross site scripting vulnerability is detected  in Juniper SA2500 VPN SSL appliance application.
The vulnerability allows remote attackers to hijack employeers sessions, moderator or admin sessions with medium 
or high required user inter action without local privileged user account. The vulnerability is located in the appliance HELP 
module with the bound vulnerable action search parameter. Successful exploitation of the vulnerability result in account 
steal, bypassing strong authentification like RSA secureid, SAFENET, Raduis,LDAP client site phishing, or client-side 
content request manipulation.
 
Vulnerable Module(s):
			[+] HELP
 
Vulnerable File(s):
			[+] https://host/dana-cached/help/fr/SA-User-Help/wwhelp/wwhimpl/js/html/wwhelp.htm
 
Vulnerable Parameter(s):
			[+] WWHSearchWordsText


Proof of Concept (PoC):
=======================
The vulnerability can be exploited by remote attackers with medium or high required user inter action and 
without privileged application user account. For demonstration or reproduce ...

<nobr>
<input name="WWHSearchWordsText" size="20" value="" type="text">
<script>alert("KAMI@VULN LAB" + document.cookie);</script>" onKeyDown="WWHFrame.WWHHelp.fIgnoreNextKeyPress
((document.all||document.getElementById||document.layers)?event:null);">
<input value="Lancer" type="submit">
</nobr>


Security Risk:
==============
The security risk of the  input validation vulnerabilities are estimated as low.


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Karim H.B. ([email protected]) [www.kami.ma]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2012 | Vulnerability Laboratory