Portcullis Security Advisory 060-056


Vulnerable System:

P-Synch.


Vulnerability Title:

The P-Synch Windows domain password reset web applications style parameter allows JavaScript injection.


Vulnerability discovery and development:

This vulnerability was discovered during an application assessment.  Further research was then carried
out post assessment.  The vendor has been notified.


Credit for Discovery:

Tim Brown of Portcullis Computer Security Ltd.


Affected systems:

All known versions of P-Synch.


Details:

It is possible to pass a remote URL for a style sheet to the P-Synch Windows domain password reset web
application within the style parameter, which will then be referenced in the web pages returned.


Impact:

An attacker could use this to execute malicious code on visitors computers using the techniques outlined
in Tim Brown's paper Misunderstanding Javascript injection[1].

[1] http://www.nth-dimension.org.uk/news/entry.php?e=156579087


Exploit:

Exploit code is not required.


Copyright:

Copyright Portcullis Computer Security Limited 2006, All rights reserved worldwide. Permission is hereby
granted for the electronic redistribution of this information. It is not to be edited or altered in any way
without the express written consent of Portcullis Computer Security Limited.


Disclaimer:

The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or itsuse. Any use of this information is at the user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use
or spread of this information.