Back to list
XSS on Juniper JUNOS 11.4 Embedthis Appweb 3.2.3
Nov 11 2013 02:19PM
info andreabodei com
Vulnerability Type: (XSS) Cross-Site Scripting
- Original release date: November 11th, 2013
- Last revised: November 11th, 2013
- Discovered by: Andrea Bodei - A2SECURE
- Severity: 4.3/10 (CVSSv2 Base Scored)
Products and affected versions:
JUNOS up to 11.4 (probably 12.1 and 12.3 vulnerable)
Vulnerability Discovered by: Andrea Bodei - info (at) andreabodei (dot) com [email concealed]
Company: A2SECURE - España
A2Secure Website: http://www.A2secure.com
Vendor Website: http://www.juniper.net
Application Website: http://freecode.com/projects/appweb
Juniper Networks, Inc. is an American manufacturer of networking equipment founded in 1996 by Mark Burke. It is headquartered in Sunnyvale, California, USA. The company designs and sells high-performance Internet Protocol network products and services. Juniper's main products include T-series, M-series, E-series, MX-series, and J-series families of routers, EX-series Ethernet switches and SRX-series security products. Junos, Juniper's own network operating system, runs on most Juniper products.
JUNOS versions 11.4, 12.1 can be managed by a web login on HTTPS port 443 through EmbedThis AppWeb Webserver 3.2.3 that is prone to (XSS) Cross Site Vulnerability in the index.php "error" parameter due to insufficient sanitising of special characters that allows to execute arbitrary scripts in the context of the user's browser.
This vulnerability could be exploited to manipulate a client session, steal tokens, steal credentials, execute administrative task, impersonate a legitimate user, perform transactions as that user or for phishing.
Juniper should try to upgrade it's OS with latest release of EmbedThis 4.4.1 or better and implement a special characters filtering
Proof Of Concepts
This URLs just pop up a custom number/lecter/word/phrase:
All information is provided without warranty. The intent is to provide information to secure infrastructure and/or systems, not to be able to attack or damage. Therefore A2Secure shall not be liable for any direct or indirect damages that might be caused by using this information.
[ reply ]
Copyright 2010, SecurityFocus