*Overview-----------------------------------------------------------------------------------------------------------------------------*
Vendor: Manage Engine
Vulnerable Product: Desktop Central v.9.1.0 Build 91099
Vulnerability Type : Reflected Cross Site Scripting Vulnerability
Vulnerable Version : v.9.1.0 Build 91099
Vendor Homepage:
https://www.manageengine.com/products/desktop-central/download.html
<https://www.manageengine.com/products/firewall/download.html>
CVE-ID : NA
Severity : Medium
Author – Omkar Joshi

Vulnerability Reported: 11/12/2015
Response From Vendor: 11/12/2015
Vendor Confirmation: 18/12/2015
Patch Released: 28/03/2016
Link:
https://www.manageengine.com/products/desktop-central/cross-site-scripting-vulnerability.html

*Product Description *
--------------------------------------------------------------------------------------------------------------------------------

Desktop Central is integrated desktop and mobile device management software
that helps in managing servers, laptops, desktops, smartphones, and tablets
from a central location.

Automate your regular desktop management routines like installing patches
<https://www.manageengine.com/products/desktop-central/windows-patch-management.html>,
distributing software
<https://www.manageengine.com/products/desktop-central/windows-software-installation.html>,
managing your IT Assets, managing software licenses
<https://www.manageengine.com/products/desktop-central/software-license-management.html>,
monitoring software usage statistics, managing USB device usage, taking
control of remote desktops, and more. It supports managing both Windows,
Mac and Linux operating systems.

Manage your mobile devices to deploy profiles and policies, configure
devices for Wifi, VPN, Email accounts, etc., apply restrictions on using
camera, browser, etc., and to secure your devices like enabling passcode,
remote lock/wipe, etc.Manage all your iOS, Android and Windows smartphones
and tablets.


*Proof of Concept URL *
-----------------------------------------------------------------------------------------------------------------------------------

http://localhost:8020/scheduleReport.do?actionToCall=showScheduleReport

*Credits & Authors*
-------------------------------------------------------------------------------------------------------------------------------------

Omkar Joshi


*Steps to Reproduce :*
*Attack Scenario*:
Step 1. Login into Desktop Central v.9.1.0
Step 2: Go to Reports.
Step 3: Click on Add Schedule Report
Step 4: Insert XSS payload in "To" parameter of "Specify Delivery Format".
I have used "><img src=x onerror=prompt(document.cookie)> XSS payload
Step 5: Then click on Save to submit the data and Script will get execute.
*Impact of attack*: An attack can perform Cross Site Scripting attack and
steal the cookie of other active sessions.

An attacker would exploit a vulnerability within a website or web
application that the victim would visit, essentially using the vulnerable
website as a vehicle to deliver a malicious script to the victim’s browser.

An attacker might be able to put stored XSS into the website.

https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

*Recommendation*: Use an appropriate combination of white listing and
blacklisting to ensure only valid and expected input is processed by the
system.
Furthermore, classes within the output tag libraries should also be
modified to encode potentially dangerous characters with their HTML escape
Counter parts.

For more information refer the following link

https://www.owasp.org/index.php
/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet