Lansweeper v6.0.0.63, XSS Vulnerability

/in

# Discovered by: Giovanni Cerrato, Giovanni Guido (BackBox Team)
# Vendor Homepage: https://www.lansweeper.com/
# Version: Lansweeper 6.0.0.63

 

I. INTRODUCTION

Lansweeper an Asset Management and Network Inventory Tool (v6.0.0.63 and probably all previous versions) is affected by a XSS vulnerability.

 

II. DESCRIPTION

The application is affected by Cross Site Scripting vulnerabilities.

An attacker can use this vulnerability to construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user’s browser in the context of that user’s session with the application. The attacker-supplied code can perform a wide variety of actions, such as stealing the victim’s session token or login credentials, performing arbitrary actions on the victim’s behalf, and logging their keystrokes. Reference: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

The vulnerable function seems doesn’t require authentication to be executed.

  • URL: hostname/GlobalActions.aspx?action=getthumbnail
  • Vulnerable parameters: username, userdomain, upn
  • Method: POST

 

III. PROOF OF CONCEPT

The vulnerability can be trigged via a POST request as shown in the following PoC’s.

Payload username parameter:

POST /GlobalActions.aspx?action=getthumbnail HTTP/1.1
type=1&id=-2&size=75&username=<script>alert(1)</script>&userdomain=&upn=

Payload userdomain parameter:

POST /GlobalActions.aspx?action=getthumbnail HTTP/1.1
type=1&id=-2&size=75&username=test&userdomain=<script>alert(1)</script>&upn=

Payload upn parameter:

POST /GlobalActions.aspx?action=getthumbnail HTTP/1.1
type=1&id=-2&size=75&username=test&userdomain=&upn=<script>alert(1)</script>

 

IV. BUSINESS IMPACT

An attacker could perform a wide variety of actions such as stealing the victim’s session token or login credentials, performing arbitrary actions on the victim’s behalf, and logging their keystrokes.

 

V. SYSTEMS AFFECTED

Version 6.0.0.63 is vulnerable (probably all previous versions).

 

VI. REFERENCES

https://www.lansweeper.com/changelog.aspx BUG: #542782
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9292

 

VII. CREDITS

The vulnerability has been discovered by the BackBox Team:

Giovanni Cerrato, giovanni(dot)cerrato(at)aizoon(dot)it
Giovanni Guido, giovanni(dot)guido(at)aizoon(dot)it

 

VIII. ADVISORY TIMELINE

April 21th, 2017: Vulnerability identification
April 21th, 2017: First contact with vendor
April 26th, 2017: Vendor notified
April 26th, 2017: Vendor response; investigating
May 2th, 2017: Vendor says that the vulnerability will be fixed in the new version
May 11th, 2017: Vulnerabilty fixed (Bug 542782)
May 23th, 2017: CVE Requested
May 29th, 2017: CVE received – “CVE-2017-9292”

 

IX. LEGAL NOTICES

The information contained within this advisory is supplied “as-is” with no warranties or guarantees of fitness of use or otherwise. We accept no responsibility for any damage caused by the use or misuse of this information.