{"id":6975,"date":"2017-03-14T14:20:35","date_gmt":"2017-03-14T22:20:35","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/03\/14\/news-766\/"},"modified":"2017-03-14T14:20:35","modified_gmt":"2017-03-14T22:20:35","slug":"news-766","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/03\/14\/news-766\/","title":{"rendered":"SSD Advisory \u2013 SolarWinds Multiple Vulnerabilities"},"content":{"rendered":"

Credit to Author: Maor Schwartz| Date: Tue, 14 Mar 2017 07:15:01 +0000<\/strong><\/p>\n

\n

Vulnerabilities Summary<\/strong>
SolarWinds Server and Application Monitor version 6.1.1 has been found to contain multiple vulnerabilities:<\/p>\n

    \n
  1. Node Custom Properties Persistent XSS<\/li>\n
  2. Audit Events Module Persistent XSS<\/li>\n
  3. Custom “Data Source” and ‘Where Clause’ Persistent XSS<\/li>\n
  4. “Build Dynamic Query Name” Persistent XSS<\/li>\n
  5. Multiple Persistent XSS Vulnerabilities Via ‘Title’ field<\/li>\n
  6. Application Monitor Template Persistent XSS<\/li>\n
  7. NOC View Name Persistent XSS<\/li>\n<\/ol>\n

    Credit<\/strong>
    An independent security researcher has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.<\/p>\n

    Vendor response<\/strong>
    We notified SolarWinds about the vulnerabilities back in August 2015, repeated attempts to re-establish contact and get some answers on the status of the patches for these vulnerabilities went unanswered. We have also contacted CERT in August 2015, but they were unable to get them to addresses these issues. At this time there is no solution or workaround for these vulnerabilities.<\/p>\n

    <\/span><\/p>\n

    Vulnerabilities Details<\/strong><\/u>
    Node Custom Properties Persistent XSS<\/u>
    The vulnerability can be found in ‘Add Custom Property<\/em>‘<\/p>\n

      \n
    1. From the Settings, click ‘Manage Nodes<\/em>‘ in the ‘Node & Group Management module<\/em>‘<\/li>\n
    2. Click ‘Add Node<\/em>‘, enter valid ip and then select ‘No Status<\/em>‘, click Next<\/li>\n
    3. Click Next, this should bring you to the ‘Change Properties<\/em>‘ section<\/li>\n
    4. Click the ‘Manage Custom Properties<\/em>‘ link.<\/li>\n
    5. Click ‘Add Custom Property<\/em>‘, then click Next.<\/li>\n<\/ol>\n

      The ‘Name<\/em>‘ and the ‘description<\/em>‘ fields do not sanitize user input, allowing HTML and Javascript code injection. The injected code is then visible (once saved) when the attached node is edited.<\/p>\n

      Sample code used:<\/p>\n

      \t\t<\/p>\n

      \n
      <\/span> \t\t\t<\/p>\n
      <\/span><\/p>\n
      \n
      <\/div>\n<\/div>\n
      \n
      <\/div>\n<\/div>\n
      \n
      <\/div>\n<\/div>\n
      \n
      <\/div>\n<\/div>\n
      \n
      <\/div>\n<\/div>\n
      \n
      <\/div>\n<\/div>\n<\/div>\n<\/div>\n
      <\/div>\n