SupportCenter Plus 7.9 Cross Site Scripting Vulnerability

Product: SupportCenter Plus
Vendor: Zoho Corp.
Vulnerable Version(s): 7.9 and probably prior
Tested Version: 7.9
Advisory Publication:  January 7, 2015  [without technical details]
Vendor Notification: January 7, 2015 
Vendor Patch: January 23, 2015 
Public Disclosure: January 28, 2015 
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2015-0866
Risk Level: Medium 
CVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in a web-based customer support software SupportCenter Plus. These vulnerabilities can be exploited to perform Cross-Site Scripting attacks against authenticated users of the vulnerable software.


1) Cross-Site Scripting (XSS) in SupportCenter Plus: CVE-2015-0866

The discovered XSS vulnerabilities can be used by attackers to steal cookies or other sensitive user data of a vulnerable website. 

Attackers can also perform more sophisticated attacks, such as spear phishing, or launch drive-by-download attacks against website users by injecting malware or exploit-packs into vulnerable scripts.

1.1 Input passed via the "fromCustomer" HTTP GET parameter to "/HomePage.do" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

A simple exploit below uses the "alert()" JavaScript function to display "ImmuniWeb" word: 

http://[host]/HomePage.do?fromCustomer=customerportal_%3C/script%3E%3Cscript%3Ealert%28/ImmuniWeb/%29%3C/script%3E

1.2 Input passed via the "username" and "password" HTTP POST parameters to "/HomePage.do" script are not properly sanitised before being returned to the user. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

Below is a simple exploit that can be used to demonstrate the vulnerability. After submitting the form two JavaScript dialog boxes will appear with "ImmuniWeb" word:


<form action="http://[host]/HomePage.do" method="post" name="main">
<input type="hidden" name="username" value='</script><script>alert(/ImmuniWeb/)</script>'>
<input type="hidden" name="password" value='</script><script>alert(/ImmuniWeb/)</script>'>
<input type="submit" id="btn">
</form>


-----------------------------------------------------------------------------------------------

Solution:

Update to SupportCenter Plus build 7941

More Information:
https://forums.manageengine.com/topic/security-update-for-supportcenter-plus

#  0day.today [2018-04-02]  #