ABUS Security Center 0101a FTP Login Username Persistent cross site scripting

Summaryinfo

A vulnerability described as problematic has been identified in ABUS Security Center 0101a. Affected by this issue is some unknown functionality of the component FTP Login. Such manipulation of the argument Username with the input <script>alert(document. cookie)</script> leads to cross site scripting (Persistent). The attack must be carried out from within the local network. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in ABUS Security Center 0101a. It has been rated as problematic. Affected by this issue is an unknown code block of the component FTP Login. The manipulation of the argument username with the input value <script>alert(document. cookie)</script> leads to a cross site scripting vulnerability (Persistent). Using CWE to declare the problem leads to CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. Impacted is integrity.

The weakness was presented 09/29/2016 by Tim Schughart and Khanh Quoc Pham as confirmed mailinglist post (Bugtraq). The advisory is available at seclists.org. The public release was coordinated in cooperation with the vendor. Access to the local network is required for this attack. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details as well as a public exploit are known. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project. The advisory points out:

he entered username via FTP login is reflected to the log which is rendered in the web interface without input validation. This results in an successfull, persistent, XSS.

A public exploit has been developed by Tim Schughart/Khanh Quoc Pham in Javascript and been published immediately after the advisory. The exploit is available at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 8 days. During that time the estimated underground price was around $0-$5k.

The mailinglist post contains the following remark:

Not fixed by Vendor, will not patch the vuln.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• ABUS

Name

• Security Center

Version

• 0101a

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion