ToutVirtual's VirtualIQ Pro is specifically designed for IT administrators responsible for managing virtual platforms. Multiple vulnerabilities has been found which a allow an attacker to conduct various XSS and CSRF attack, and other attacks due to the use of an old an not hardened version of the web server.
An attacker can perform different types of CSRF attacks against a logged user.
He can, for example, shutdown, start or restart an arbitrary virtual machine, schedule new activities and so on.
The following HTTP request, if forged by the attacker and executed by the victim while logged on VirtualIQ, creates an arbitrary user:
POST /tvserver/user/user.do?command=save&userId= HTTP/1.1
Host: server:9080
Cookie: JSESSIONID=[...]
VirtualIQ runs on top of an old version of Apache Tomcat: 5.5.9, for which multiple public vulnerabilities have been released. As a PoC, a directory traversal attack (CVE-2008-2938) can be performed as:
Tomcat status page should be disabled or restricted, being accessible at:
http://status:9080/status
Username and password to access a VM through SSH are also available in clear text in the configuration page.
Since an XSS vulnerability can also be triggered in the same page, an attacker would also be able to easily capture the full credentials to access the VM with a specially crafted XSS payload.
(e) Remote code execution
JBoss JMX Management Console is exposed and can be used by remote attackers to execute arbitrary commands on the system:
http://server:9080/jmx-console/
JBoss Web Console is exposed as well and can be used by remote attackers to execute any command on the system:
http://server:9080/web-console/
Disclosure Timeline:
Vendor disclosure: 02/07/2009
Vendor acknowledged: 16/07/2009
Vendor patch release: notified us on 06/11/2009
Public disclosure: 07/11/2009
--------------------------------------------------------------------------------------------------------------------------------
Vulnerabilities like this exist in many sites. Find out how to eliminate XSS.
*
