A vulnerability, which was classified as problematic, was found in Astaro Gateway 8.101. Affected is an unknown code block of the component Certificate. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. This is going to have an impact on integrity.

The weakness was presented 12/26/2011 as VL-ID 193 as not defined advisory (Website). The advisory is shared for download at vulnerability-lab.com. The public release happened without coordination with the vendor. The exploitability is told to be easy. It is possible to launch the attack remotely. The requirement for exploitation is a authentication. Successful exploitation requires user interaction by the victim. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

A public exploit has been developed in HTML/Javascript and been published immediately after the advisory. The exploit is shared for download at vulnerability-lab.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 196 days. During that time the estimated underground price was around $0-$5k. The code used by the exploit is:

<div style="left: 300px; top: 220px; z-index: 2000; visibility: visible;" class="iPopUp" id="iPopup_2"><div 
class="iPopUpTitle">Please confirm:</div><div class="iPopUpText"><p>&#8203;&#8203;&#8203;&#8203;&#8203;Are you sure that you want to delete the X509 certificate 
with private key object '>"<INCLUDED PERSISTENT SCRIPTCODE HERE!!!">'?</p></iframe></p></div><table border="0" 
cellpadding="0" cellspacing="0"><tbody><tr><td style="padding: 2px;"><div id="btnDefault_iPopup_2" class="button" style="width: 
auto; cursor: pointer; color: black; font-weight: bold;"><div class="button_left"></div><div class="button_center" style="width: 
auto;"><span style="font-weight: normal;">OK</span></div><div class="button_right"></div></div></td>&#8203;&#8203;&#8203;&#8203;&#8203;<td style="padding: 
2px;"><div class="button" style="width: auto; cursor: pointer; color: black;"><div class="button_left"></div><div 
class="button_center" style="width: auto;"><span style="font-weight: normal;">Cancel</span></div><div 
class="button_right"></div></div></td></tr></tbody></table></div>

Upgrading to version 8.301 eliminates this vulnerability. A possible mitigation has been published 3 weeks after the disclosure of the vulnerability.

Productinfo

Vendor

• Astaro

Name

• Gateway

Version

• 8.101

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion