exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

LANSA aXes Web Terminal Cross Site Scripting

LANSA aXes Web Terminal Cross Site Scripting
Posted May 1, 2011
Authored by Patrick Webster

LANSA aXes Web Terminal (TN5250) suffers from a cross site scripting vulnerability.

tags | exploit, web, xss
SHA-256 | a015d5357f35b389714d88ff7ffc8b31be4d05cf80d5372754c4d9f4734d92af

LANSA aXes Web Terminal Cross Site Scripting

Change Mirror Download
LANSA aXes Web Terminal (TN5250) Cross-Site Scripting Vulnerability
http://www.osisecurity.com.au/advisories/lansa-axes-web-terminal-tn5250-cross-site-scripting

Release Date:
30-Apr-2011

Software:
LANSA - aXes
http://www.lansa.com
http://www.axeslive.com

"Transform your 5250 applications into GUI browser-based applications
automatically – without changing any lines of your source code. Work with
IBM i, System i, iSeries and AS/400 5250 applications securely and efficiently
from browser-based devices running across the Internet, inside your corporate
Intranet or on a mobile network."

Versions tested:
Version V1R3M5 / VRM130.000 (135001) has been confirmed as
vulnerable. Other versions untested.

Vulnerability discovered:
Cross-site Scripting

Vulnerability impact:
Low - Remote content may contain JavaScript which is client executed.
May be used to steal authentication information.

Vulnerability information:
The remote page may contain JavaScript for XSS purposes, e.g. cookies.

Example:

https://[target]/axests/terminal?cssref=/ts/skins/axes_default.css?axbuild=135001&login="><script>alert("XSS");</script>

Recommendation:

Vendor did not respond.

Workaround:

Disable JavaScript, use a WAF / IDS etc.

Credit:
This vulnerability was discovered by Patrick Webster.

Disclosure timeline:
18-Sep-2010 - Discovered during audit.
23-Sep-2010 - Notified vendor. Received automated support ticket.
30-Apr-2011 - Disclosure.

About OSI Security:

OSI Security is an independent network and computer security auditing
and consulting company based in Sydney, Australia. We provide internal
and external penetration testing, vulnerability auditing and wireless
site audits, vendor product assessments, secure network design,
forensics and risk mitigation services.

We can be found at http://www.osisecurity.com.au/
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    9 Files
  • 7
    Feb 7th
    32 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close