exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

LANSA aXes Web Terminal Cross Site Scripting

LANSA aXes Web Terminal Cross Site Scripting
Posted May 1, 2011
Authored by Patrick Webster

LANSA aXes Web Terminal (TN5250) suffers from a cross site scripting vulnerability.

tags | exploit, web, xss
SHA-256 | a015d5357f35b389714d88ff7ffc8b31be4d05cf80d5372754c4d9f4734d92af

LANSA aXes Web Terminal Cross Site Scripting

Change Mirror Download
LANSA aXes Web Terminal (TN5250) Cross-Site Scripting Vulnerability
http://www.osisecurity.com.au/advisories/lansa-axes-web-terminal-tn5250-cross-site-scripting

Release Date:
30-Apr-2011

Software:
LANSA - aXes
http://www.lansa.com
http://www.axeslive.com

"Transform your 5250 applications into GUI browser-based applications
automatically – without changing any lines of your source code. Work with
IBM i, System i, iSeries and AS/400 5250 applications securely and efficiently
from browser-based devices running across the Internet, inside your corporate
Intranet or on a mobile network."

Versions tested:
Version V1R3M5 / VRM130.000 (135001) has been confirmed as
vulnerable. Other versions untested.

Vulnerability discovered:
Cross-site Scripting

Vulnerability impact:
Low - Remote content may contain JavaScript which is client executed.
May be used to steal authentication information.

Vulnerability information:
The remote page may contain JavaScript for XSS purposes, e.g. cookies.

Example:

https://[target]/axests/terminal?cssref=/ts/skins/axes_default.css?axbuild=135001&login="><script>alert("XSS");</script>

Recommendation:

Vendor did not respond.

Workaround:

Disable JavaScript, use a WAF / IDS etc.

Credit:
This vulnerability was discovered by Patrick Webster.

Disclosure timeline:
18-Sep-2010 - Discovered during audit.
23-Sep-2010 - Notified vendor. Received automated support ticket.
30-Apr-2011 - Disclosure.

About OSI Security:

OSI Security is an independent network and computer security auditing
and consulting company based in Sydney, Australia. We provide internal
and external penetration testing, vulnerability auditing and wireless
site audits, vendor product assessments, secure network design,
forensics and risk mitigation services.

We can be found at http://www.osisecurity.com.au/
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close