what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Qiata FTA 1.70.19 Cross Site Scripting

Qiata FTA 1.70.19 Cross Site Scripting
Posted Sep 30, 2020
Authored by Patrick Hener | Site syss.de

Qiata FTA versions 1.70.19 and below suffer from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2020-14294
SHA-256 | ffa825bb3a9b050965fbf372d65a3eb70ac962e897f3c02dab225c86de686b1c

Qiata FTA 1.70.19 Cross Site Scripting

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2020-024
Product: Qiata FTA
Manufacturer: Secudos GmbH
Affected Version(s): <= Qiata FTA 1.70.19
Tested Version(s): Qiata FTA 1.70.19
Vulnerability Type: Cross-Site Scripting (CWE-79)
Risk Level: Medium
Solution Status: Solved
Manufacturer Notification: 2020-06-17
Solution Date: 2020-08-12
Public Disclosure: 2020-09-28
CVE Reference: CVE-2020-14294
Author of Advisory: Patrick Hener, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

Qiata FTA is a secure file transfer appliance.

The manufacturer describes the product as follows (see [1]):

"Qiata File Transfer Appliances (FTAs) provide the ability to easily and
securely exchange files with internal or external users."

Due to insufficient input validation of user-provided input, it is
vulnerable
to cross-site scripting.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

Within every transfer initiated, both the sender and the receiver of the
transfer are able to communicate via a comment function.

This comment function does in fact alter user input and change appearances
of the special characters '<' and '>' by flipping the direction of the
special
character. Also, quotation marks are escaped properly.

An attacker can use the behavior to construct a malicious string, which will
embed persistent cross-site scripting within the transfer comments. The
exploit will be executed when viewing the transfer comments.

For a user not registered within the file transfer appliance, the
exploit will
be executed directly when opening the provided transfer URL.

This vulnerability is also discovered at the global notice board where
no escaping could be identified.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The following string will result in persistent cross-site scripting
displaying the message "Persistent XSS by SySS GmbH" when executed. All an
attacker needs to do is to enter the malicious string as a comment to a
transfer.

">img src=x
onerror=alert(String.fromCharCode(80,101,114,115,105,115,116,101,
110,116,32,88,83,83,32,98,121,32,83,121,83,83,32,71,109,98,72)) /<"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

The vulnerability was fixed with version Qiata FTA 2.00.00. Update to at
least this version.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2020-06-02: Vulnerability discovered
2020-06-17: Vulnerability reported to manufacturer
2020-08-12: Patch released by manufacturer
2020-09-28: Public disclosure of vulnerability

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product Website for Qiata FTA
https://www.secudos.de/en/products/qiata-file-transfer
[2] SySS Security Advisory SYSS-2020-024

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-024.txt
[3] SySS Responsible Disclosure Policy
https://www.syss.de/en/news/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Patrick Hener of SySS
GmbH.

E-Mail: patrick.hener@syss.de
Public Key:
https://www.syss.de/fileadmin/dokumente/PGPKeys/Patrick_Hener.asc
Key ID: 5C708555930AA477
Key Fingerprint: 9CB7 1E87 BD83 64B7 38F2 3434 5C70 8555 930A A477

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEnLceh72DZLc48jQ0XHCFVZMKpHcFAl9x+BAACgkQXHCFVZMK
pHf6GQ/+OrFPbyLseRztdPeHW0F1c25yj6KNn50KFGZ7AvHmE+o3Cv/A071UpdjA
OSanp572MAiPNCsKX5C0c9vZr1B6nCMfNRE86qvusYDzVp8tE0/x2H7plXZmQrJ5
8w44vNWKGapkYarxhvYwRa6EQ3Hc6UZvgt86KzulYJKXj71sHb9mzmJQstfl3Fa/
bCinLbT1qcSkrQx9gSw/u5CdRCTR1ZykBIXGKnegsiuw3E3bsGWXd+qRggbk/Er4
upw2aONZ8wZbvs6+gtLcVA9ZaDOmTyNRV3wMfMRtny+EZhZoqErSD1gd2fbyDcEl
IigI/9kd4SDwgxkyq5oZTCEcB8CB9Ealm31kYjhKBb1m2pn9dmr6SLDgXkI8ykcE
n4P57utS2Xl++hqBrXvn+Su/qFkQJby7uT14KkUR9y3WezLjwp42E3tH7o+qhNig
1+bjeGC2aiy3BEULEK51CuVQFYRREZ7AkkeUfzfZvFiIAelWVa5tN0f+sPUfGZwl
JI+VfsrhRHP05BTK5DQMUv+Am3Xk6Mh+NgRgGWqgLbb5XNvjttYx4/SXDO4xMpcz
7NKdy9QIo9tzRTa0RDtzhBgR5wmyMcjdkZ7PX8MiPfgEgljF03qK51gL2vCv7t6H
Gb8IwpJmyZUxov7kGJe6mzyLA7UqkXC5YMTXKYotXjqpbzCuUro=
=329f
-----END PGP SIGNATURE-----


Login or Register to add favorites

File Archive:

August 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    15 Files
  • 2
    Aug 2nd
    22 Files
  • 3
    Aug 3rd
    0 Files
  • 4
    Aug 4th
    0 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    11 Files
  • 7
    Aug 7th
    43 Files
  • 8
    Aug 8th
    42 Files
  • 9
    Aug 9th
    36 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    27 Files
  • 13
    Aug 13th
    18 Files
  • 14
    Aug 14th
    50 Files
  • 15
    Aug 15th
    33 Files
  • 16
    Aug 16th
    23 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    43 Files
  • 20
    Aug 20th
    29 Files
  • 21
    Aug 21st
    42 Files
  • 22
    Aug 22nd
    26 Files
  • 23
    Aug 23rd
    25 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close