what you don't know can hurt you

1830 Photonic Service Switch PSS-32/16/4 Cross Site Scripting

1830 Photonic Service Switch PSS-32/16/4 Cross Site Scripting
Posted Dec 1, 2014
Authored by Stephan Rickauer

Swisscom CSIRT discovered a security flaw in the management interface of the Alcatel Lucent 1830 Photonic Service Switch series that allows for cross site scripting attacks. Versions 6.0 and below are affected.

tags | exploit, xss
advisories | CVE-2014-3809
MD5 | 706f736a374525d8e2a7f918de304c0b

1830 Photonic Service Switch PSS-32/16/4 Cross Site Scripting

Change Mirror Download
#############################################################
#
# SWISSCOM CSIRT ADVISORY - http://www.swisscom.com/security
#
#############################################################
#
# CVE ID: CVE-2014-3809
# Product: 1830 Photonic Service Switch PSS-32/16/4
# Vendor: Alcatel-Lucent
# Subject: Reflected Cross-site Scripting - XSS
# Effect: Remotely exploitable
# Author: Stephan Rickauer (stephan.rickauer _at_ swisscom.com)
# Date: December 1st 2014
#
#############################################################


Introduction:
-------------
Swisscom CSIRT discovered a security flaw in the management interface
of the Alcatel Lucent 1830 Photonic Service Switch series.


Vulnerable:
-----------
All Switches of Release 6.0 or lower are vulnerable.


Patches:
--------
None.


Description:
------------
The management interface of the 1830 Photonic Switch series is vulnerable
to reflected cross-site scripting, since user input is not properly encoded
on output. Exploiting this vulnerability will lead to so-called cross-site
scripting (XSS) and allows the impersonation of logged-in admin users.
Additionally, the myurl-Parameter accepts non-local web addresses, which
can be abused to redirect victims to arbitrary web sites.


Attack vector:
--------------
https://xx.xx.xx.xx/menu/pop.html?myurl=);<script>alert('xss')</script>


Statement Vendor:
-----------------
"The vulnerability is assessed at no risk. We will evaluate if/when we
will add the best practice of validating all inputs in WebUI tasks, but
this is not considered high priority for the roadmap."


Milestones:
-----------
May 21st 2014 Vulnerability discovered
May 21st 2014 CVE requested
June 13th 2014 Vendor contact established and provided with technical details
June 16th 2014 Vendor acknowledged issue (Psirt.Security at alcatel-lucent.com)
Aug. 28th 2014 Vendor update requested
Okt. 1st 2014 Vendor update requested
Dec. 1st 2014 Vendor update requested
Dec. 1st 2014 Vendor assess XSS not to be an issue
Dec. 1st 2014 Public release of advisory
Login or Register to add favorites

File Archive:

September 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    14 Files
  • 2
    Sep 2nd
    19 Files
  • 3
    Sep 3rd
    9 Files
  • 4
    Sep 4th
    1 Files
  • 5
    Sep 5th
    2 Files
  • 6
    Sep 6th
    3 Files
  • 7
    Sep 7th
    12 Files
  • 8
    Sep 8th
    22 Files
  • 9
    Sep 9th
    17 Files
  • 10
    Sep 10th
    19 Files
  • 11
    Sep 11th
    3 Files
  • 12
    Sep 12th
    2 Files
  • 13
    Sep 13th
    15 Files
  • 14
    Sep 14th
    16 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    7 Files
  • 17
    Sep 17th
    13 Files
  • 18
    Sep 18th
    2 Files
  • 19
    Sep 19th
    2 Files
  • 20
    Sep 20th
    14 Files
  • 21
    Sep 21st
    20 Files
  • 22
    Sep 22nd
    28 Files
  • 23
    Sep 23rd
    13 Files
  • 24
    Sep 24th
    10 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close