+------------------------------------------------------+
+ Ericsson Drutt MSDP (3PI Manager) - Open Redirection +
+------------------------------------------------------+
Affected Product: Ericsson Drutt MSDP (3PI Manager)
Vendor Homepage  : www.ericsson.com
Version    : 4, 5 and 6 
CVE v2 Vector  : AV:N/AC:M/Au:S/C:N/I:P/A:N
CVE    : CVE-2015-2167
Discovered by  : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched    : Yes

+-------------+
+ Description +
+-------------+
Ericsson Drutt Mobile Service Delivery Platform (MSDP) is a complete business support system providing an SDP center for both on- and off-portal business that includes support for the retail, advertising and wholesale of a wide range of different products and services. The MSDP was originally developed by Drutt Corporation which Ericsson bought back in 2007. Drutt was converted into Ericsson SA SD&P and they are still developing the MSDP. The platform is available in three configurations which also can be combined in the same installation: Storefront, Mobile Marketing and Open Surf.

The identified vulnerability affects the 3PI Manager component and allows remote attackers to redirect (authenticated) users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

+----------------------+
+ Exploitation Details +
+----------------------+
The vulnerable parameter and the respective URL path is listed below:

http://<drutt>:<port>/jsp/start-3pi-manager.jsp?url=http://www.google.com

+---------------------+
+ Disclosure Timeline +
+---------------------+
17.Feb.2015 - Contacted Ericsson http://www.ericsson.com/feedback
24.Feb.2015 - Ericsson responded with point of contact at Corporate Security Office
24.Feb.2015 - Contacted Corporate Security Office team
02.Mar.2015 - Ericsson Product Security Incident Response Team reverted via a secure channel
02.Mar.2015 - Shared vulnerability details
06.Mar.2015 - Ericsson confirmed the validity of the issues and started developing the patches
08.Mar.2015 - Agreed on public disclosure timelines
12.Mar.2015 - Patches released
31.Mar.2015 - Public disclosure