exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Lansweeper 6.0.0.63 Cross Site Scripting

Lansweeper 6.0.0.63 Cross Site Scripting
Posted Oct 5, 2017
Authored by BackBox Team, Giovanni Cerrato, Giovanni Guido

Lansweeper version 6.0.0.63 suffers from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2017-9292
SHA-256 | 4b22abdddc1c837b9570e576fea285a43af05467d3f4ec06042d5ab9f5b354b9

Lansweeper 6.0.0.63 Cross Site Scripting

Change Mirror Download
=============================================
- Release date: October 05th, 2017
- Discovered by: Giovanni Cerrato, Giovanni Guido and BackBox team

- Severity: Medium
=============================================

I. VULNERABILITY
-------------------------

Lansweeper XSS vulnerability.


II. INTRODUCTION
-------------------------

Lansweeper an Asset Management and Network Inventory Tool (v6.0.0.63 and
probably all previous versions) is affected by a Xss vulnerability.


III. DESCRIPTION
-------------------------

1) REFLECTED CROSS SITE SCRIPTING

The application is affected by Cross Site Scripting vulnerabilities. An
attacker can use this vulnerability to construct a request that, if issued
by another application user, will cause JavaScript code supplied by the
attacker to execute within the useras browser in the context of that useras
session with the application. The attacker-supplied code can perform a wide
variety of actions, such as stealing the victimas session token or login
credentials, performing arbitrary actions on the victimas behalf, and
logging their keystrokes. Reference:
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)


A* URL: hostname/GlobalActions.aspx?action=getthumbnail
A* Vulnerable parameters: username, userdomain, upn
A* Method: POST


POC (proof of concept)

The vulnerability can be trigged via a POST request as shown in the
following PoC's.

Payload username parameter:
POST /GlobalActions.aspx?action=getthumbnail HTTP/1.1
type=1&id=-2&size=75&username=<script>alert(1)</script>&userdomain=&upn=

Payload userdomain parameter:
POST /GlobalActions.aspx?action=getthumbnail HTTP/1.1
type=1&id=-2&size=75&username=test&userdomain=<script>alert(1)</script>&upn=

Payload upn parameter:
POST /GlobalActions.aspx?action=getthumbnail HTTP/1.1
type=1&id=-2&size=75&username=test&userdomain=&upn=<script>alert(1)</script>



IV. BUSINESS IMPACT
-------------------------

An attacker could perform a wide variety of actions such as stealing the
victimas session token or login credentials, performing arbitrary actions
on the victimas behalf, and logging their keystrokes.


V. SYSTEMS AFFECTED
-------------------------

Version 6.0.0.63 is vulnerable (probably all previous versions)


VI. SOLUTION
-------------------------

Upgrade to version 6.0.0.65 or later.


VII. REFERENCES
-------------------------

lansweeper website:

https://www.lansweeper.com/
https://www.lansweeper.com/changelog.aspx BUG: #542782


VIII. CREDITS
-------------------------

The vulnerability has been discovered by:

Giovanni Cerrato giovanni(dot)cerrato(at)aizoon(dot)it
Giovanni Guido giovanni(dot)guido(at)aizoon(dot)it
BackBox team info(at)backbox(dot)org


IX. ADVISORY TIMELINE
-------------------------

April 21th, 2017: Vulnerability identification
April 21th, 2017: First contact with vendor
April 26th, 2017: Vendor notified
April 26th, 2017: Vendor response; investigating
May 2th, 2017: Vendor says that the vulnerability will be fixed in the new
version
May 11th, 2017: Vulnerabilty fixed (Bug 542782). Reference:
https://www.lansweeper.com/changelog.aspx
May 23th, 2017: CVE Requested
May 29th, 2017: CVE received - "CVE-2017-9292"
September 18th, 2017: Vulnerability published on backbox.org URL:
https://backbox.org/membership/lansweeper-v6-0-0-63-xss-vulnerability/
October 04th, 2017: cve updated



X. LEGAL NOTICES
-------------------------

The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise. We accept no
responsibility for any damage caused by the use or misuse of this
information.


<http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Mail
priva di virus. www.avg.com
<http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>


Login or Register to add favorites

File Archive:

December 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    11 Files
  • 2
    Dec 2nd
    0 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close