BMC Footprints Service Core 11.5 - Multiple Cross Site Scripting Vulnerabilities (XSS)

[ayman.abdelaziz@xxxxxxxxxx]

About the Product:
BMC FootPrints Service Core is an IT service and asset management platform used 
by many organizations to help the IT departments deliver more value to 
businesses.

Advisory Details:

During a Penetration testing, Help AG auditor (Ayman Abdelaziz) discovered the 
following:
1) Stored Cross-Site Scripting (XSS) vulnerability in BMC Footprints Service 
Core 11.5 (MRTicketPage.pl), allows remote attackers to inject arbitrary web 
script or HTML via the Email Address form field when openning a request ticket.

Proof of Concept:
Inject the following JavaScript <script>alert('XSSed')</script> in the Email 
address form field in the (MRTicketPage.pl).


2) Reflected Cross-Site Scripting (XSS) vulnerability in BMC Footprints Service 
Core 11.5 (MRServiceCatalog.pl), allows remote attackers to inject arbitrary 
web script or HTML via the 'USER' or 'MRP' URL parameters.

Proof of Concept:
Inject the following JavaScript <script>alert('XSSed')</script> in the 'USER' 
or 'MRP' URL parameters as the following:
http://domain/MRcgi/MRServiceCatalog.pl/CMDB_ID=3&USER=test%3Cscript%3Ealert%28%27XSSed%27%29%3C%2fscript%3E&MRP=0F0JTvCEm&PROJECTID=12&CUSTM=test
or
http://domain/MRcgi/MRServiceCatalog.pl/CMDB_ID=3&USER=test&MRP=0F0JTvCEm%3Cscript%3Ealert%28%27XSSed%27%29%3C%2fscript%3E&PROJECTID=12&CUSTM=test


Solution:

After contacting the vendor (BMC Software, Inc.) about the vulnerability for a 
solution, they confirmed that it was solved with a software upgrade, the 
response was the following:

"Changes were made to the application code in version 11.6.03 to avoid this 
vulnerability, so if you upgrade to 11.6.03 or later you should find that this 
is no longer a problem"


[1] help AG middle East (http://www.helpag.com/).
[2] BMC Software Inc. (http://www.bmc.com/).
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - 
international in scope and free for public use, CVEA® is a dictionary of 
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to 
developers and security practitioners, CWE is a formal list of software 
weakness types.