[DCA-2011-0016] - Tufin SecureTrack Cross Site Script

[Ewerson Guimarães (Crash) - Dclabs <crash@xxxxxxxxxxxxx>]

[Discussion]

- DcLabs Security Research Group advises about the following vulnerability(ies):

[Software]

- Tufin SecureTrack

[Vendor Product Description]

- Features powerful tools to track changes, analyze device
configurations, optimize rule bases, and more on leading vendor
firewalls, routers, switches and network devices. Maintains a
continuous audit trail for accurate accountability and provides
built-in reports such as PCI DSS to comply with standards and reduce
audit preparation time by 50%.

- Site: http://www.tufin.com


[Advisory Timeline]

- 12/02/2011 -> First Contact requesting security department contact;
- 12/02/2011 -> Vendor reply

- 12/05/2011 -> New Contatc
- 12/09/2011 -> Advisory sent to Vendor
- 12/09/2011 -> Coordinate to disclosure
- 03/15/2012 -> Bug Fixed

- 04/04/2012 -> Public disclosure

[Bug Summary]

- Persistent/Stored Cross-Site Scripting (XSS) (A common user can
launch Xss attack using the any fields (First Name,Last Name and
others). This Xss is executed in any other logged user context,
included admin)


- Non-Persistent Cross-Site Scripting (XSS) - Must a valid session.

[Impact]

- Medium


[Affected Version]

- 6.1 build 20596

[Not Affected Version]

6.1 HF10, build 22595



[Bug Description and Proof of Concept]


- Exploiting the HTML-injection issue allows an attacker to execute
HTML and Java Script code in the remote user context to steal
cookie-based authentication credentials or to control how the site is
rendered to the user; other attacks may also be possible.

- Moreover, Cross Site Scripting (XSS) vulnerabilities are caused due
to lack of input validation. This allows malicious people to inject
arbitrary HTML and script code. More info at:
http://en.wikipedia.org/wiki/Cross-site_scripting



All flaws described here were discovered and researched by:

Ewerson Guimaraes aka Crash

DcLabs Security Research Group
crash (at) dclabs <dot> com <dot> br

[Patch(s) / Workaround]


Update to 6.1 HF10, build 22595


[Greetz]
DcLabs Security Research Group.

-- 
Ewerson Guimaraes (Crash)
Pentester/Researcher
DcLabs Security Team
www.dclabs.com.br