Zoho OpManager < v12

[d_fens@xxxxxxxxxxxxxxx]

Reported these 27/08/2015 these were eventually fixed in version 12 because the 
entire application is based on emberjs now. There are no CVEs for these issues 
assigned nor is there any acknowledgement of the issues in any patches. 
Therefore only version 12 fixes these.

Multiple stored and reflected XSS as well as CSRF. There are also multiple 
issues related to content-type and one related to overwriting local files that 
wasn't reported and passwords being disclosed. Basically prior to version 12 
opmanager is riddled with security issues

The following are stored XSS:
/admin/ConfigURLMonitor.do [fieldname]
/admin/MaintenanceTask.do [selectedAvailableDevices]
/admin/MaintenanceTask.do [selectedDevicesToMove]
/admin/ScheduleMgmt.do [repName]
/api/json/admin/getSysLogForwarders [destHost]
/api/json/device/getDeviceSummary [clName]
/api/json/reports/getReportsList [repName]
/devices/AddNewCF.do [fieldname]
/devices/DeviceCustomFields.do [fieldname]
/devices/manageUnmanage.do [fieldname]
/devices/manageUnmanage.do [fieldname]
/reports/ReportsIndex.do [repName]
/reports/ReportsIndex.do [repName]

The following are reflected XSS attacks
/admin/AddDeviceTypeForm.do [oid]
/admin/AddDeviceTypeForm.do [operationmode]
/admin/ConfigURLMonitor.do [ipAddress]
/admin/DependencyList.do [selectedTab]
/admin/DependencyList.do [selectedTab]
/admin/DeviceAssociation.do [selectedTab]
/admin/EditDeviceGraph.do [operation]
/admin/InvokeDeviceType.do [PAGE_NUMBER]
/admin/MaintenanceTask.do [selectedAvailableDevices]
/admin/MaintenanceTask.do [selectedDevicesToMove]
/admin/MaintenanceTask.do [taskID]
/admin/MibTool.do [selectedmib]
/admin/SNMPTrapProcessors.do [PAGE_NUMBER]
/admin/SNMPTrapProcessors.do [PAGE_NUMBER]
/admin/SNMPTrapProcessors.do [operation]
/admin/SNMPTrapProcessors.do [operation]
/admin/SNMPTrapProcessors.do [operation]
/admin/SNMPTrapProcessors.do [operation]
/admin/ServiceConfiguration.do [operation]
/admin/ServiceConfiguration.do [operation]
/admin/ServiceConfiguration.do [operation]
/admin/SetupSDesk.do [AutoSync]
/admin/SetupSDesk.do [Merge]
/admin/SetupSDesk.do [ticketType]
/admin/SysLogRules.do [SysLogPort]
/admin/SysLogRules.do [SysLogPort]
/admin/SysLogRules.do [status]
/admin/TrapConfiguration.do [PAGE_NUMBER]
/admin/TrapConfiguration.do [status]
/admin/ViewFailoverDetails.do [endDate]
/admin/ViewFailoverDetails.do [endDate]
/admin/ViewFailoverDetails.do [endHour]
/admin/ViewFailoverDetails.do [endHour]
/admin/ViewFailoverDetails.do [startDate]
/admin/ViewFailoverDetails.do [startDate]
/admin/ViewFailoverDetails.do [startHour]
/admin/ViewFailoverDetails.do [startHour]
/admin/ViewFailoverDetails.do [viewLength]
/customDashboard.do [dashboardName]
/devices/AddNewCF.do [fieldname]
/devices/AddNewCF.do [type]
/devices/CustomLinks.do [name]
/devices/DeviceCustomFields.do [type]
/devices/Search.do [searchTerm]
/devices/deviceinfo.do [devicename]
/devices/graphview.do [name]
/devices/manageUnmanage.do [displayName]
/devices/manageUnmanage.do [ipAddress]
/devices/objectdetails.do [displayName]
/devices/objectdetails.do [ipAddress]
/devices/updateStatus.do [displayName]
/devices/updateStatus.do [ipAddress]
/fault/AlarmView.do [displayName]
/map/AddFileMonitor.do [devicename]
/map/AddFileMonitor.do [displayName]
/map/AddFileMonitor.do [ipAddress]
/map/AddNotification.do [devicename]
/map/AddNotification.do [displayName]
/map/AddNotification.do [ipAddress]
/map/AddProcesses.do [deviceName]
/map/AddProcesses.do [displayName]
/map/AddProcesses.do [ipAddress]
/map/AddServices.do [devicename]
/map/AddServices.do [devicename]
/map/AddServices.do [devicename]
/map/EditMap.do [source]
/map/FileMonitorTemplates.do [devicename]
/map/FileMonitorTemplates.do [monitorType]
/map/InvokeDeviceType.do [devicename]
/map/InvokeDeviceType.do [devicename]
/map/InvokeDeviceType.do [devicename]
/map/InvokeMonitoring.do [devicename]
/map/InvokeMonitoring.do [devicename]
/map/MapView.do [displayName]
/map/SnpUpdateServices.do [displayName]
/map/SnpUpdateServices.do [ipAddress]
/map/UpdateDeviceType.do [devicename]
/modifyDashboard.do [dashboardName]
/reports/Availability.do [bview]
/reports/Availability.do [reportGroup]
/reports/Availability.do [reportGroup]
/reports/Availability.do [reportGroup]
/reports/Availability.do [reportGroup]
/reports/Availability.do [reportGroup]
/reports/Availability.do [viewCount]
/reports/NewReport.do [repName]
/reports/NewReport.do [repName]
/reports/NewReport.do [repName]
/reports/NewReport.do [repName]
/reports/deviceAvailability.do [deviceName]
/reports/deviceAvailability.do [deviceName]
/reports/deviceAvailability.do [deviceName]
/reports/deviceAvailability.do [deviceName]
/webclient/admin/jsp/DeviceQuery.jsp [oidtext]


Vulnerable to CSRF:
/SavePreferences.do
/TabMenu.do
/admin/AddCriteria.do
/admin/AddIPSLAMonitor.do
/admin/BenchmarkDataUpload.do
/admin/BulkDeviceAssociation.do
/admin/BulkEditDeviceGraph.do
/admin/CategoryOperation.do
/admin/ConfigureProfile.do
/admin/DBManagement.do
/admin/DependencyList.do
/admin/DeviceAssociation.do
/admin/EditInterfaceTemplates.do
/admin/EditInterfaceTemplates1.do
/admin/ImportWorkflow.do
/admin/MaintenanceTask.do
/admin/RebrandOPM.do
/admin/SNMPTrapProcessors.do
/admin/SaveInterfaceTemplates.do
/admin/ScheduleMgmt.do
/admin/ScriptMonitor.do
/admin/ScriptTemplateImport.do
/admin/SelectQCW.do
/admin/ServiceConfiguration.do
/admin/SetupSDesk.do
/admin/ShareTemplate.do
/admin/SysLogNotification.do
/admin/SysLogRules.do
/admin/TrapNotification.do
/admin/UpdateAlarmEscalation.do
/admin/ViewFailoverDetails.do\
/cctvConfig.do
/devices/AddFromCSV.do
/devices/CustomLinks.do
/devices/switchPortMapTool.do
/map/L2Map.do
/map/SnmpDetails.do
/reports/AuditReport.do
/reports/GenerateReports.do
/reports/SelectDevice.do
/reports/deviceAvailability.do
/topo/addNewNetwork.do

Additionally

GET /api/json/device/getDeviceSummary?name=localhost&apiKey=aaaa&_bbbb

:false,"deviceName":"localhost","sysDescr":"","isNetwork":false,"responseTime":"001ms","ipAddress":"127.0.0.1","ramSize":"NA","vendorName":"Unknown","pollUsing":"ICMP","status":"L..schen","community":"public","dnsName":"localhost","availdata":{"Down":0,"Not
Monitored":0,"Up":100,"Parent Down":0,"Dependent Unavailable":0,"On
Hold":0,"On 
Maintenance":0},"customLinks":[],"isvCenter":false,"isSNMP":false,"snm

This returns the community password for SNMP devices. This can allows someone 
malicious on the panel or via XSS collect SNMP passwords.