Jump to content
KhiZaRix

Palo Alto Traps Server 3.1.2.1546 Cross Site Scripting

Recommended Posts

------------------------------------------------------------------------

Product: Palo Alto Traps Server (formerly Cyvera Endpoint Protection)

Vendor: Palo Alto Networks

Vulnerable Version(s): 3.1.2.1546

Tested Version: 3.1.2.1546

Advisory Publication: 29 March 2015

Vendor Notification: 17 October 2014

Vulnerability Type: Stored Cross Site Scripting

CVE Reference: CVE-2015-2223

Risk Level: High

Solution Status:

Discovered and Provided: Michael Hendrickx, help AG

------------------------------------------------------------------------

About the product:

Palo Alto Traps is an advanced endpoint protection suite that detects attacks such as memory corruption, executable child processes, DLL hijacking, etc. Aside from optionally blocking it, it sends this ?trap? to a central server for logging purposes.

About the vulnerability:

An attacker can send a SOAP request with JavaScript embedded inside it, which gets stored in the database. When an administrator monitors the Traps? admin screen and opens details about the vulnerability, the JavaScript is executed on the admin browser.

The XSS works in the <b:Arguments>, <b:FileName> and <b:URL> parameters, for example:

<b:Arguments>"C:\\Users\\Michael\\fake.exe"

<script>

alert("xss");

</script>

</b:Arguments>

A POC script can be found at the following URL:

https://github.com/ndrix/random-scripts/blob/master/pa_traps_xss.rb

------------------------------------------------------------------------

Solution:

The vendor was notified back in October 2014, and a we?ve sent a few follow ups since. Contact the vendor for the patch details.

References:

[1] help AG middle East: http://www.helpag.com/

[2] Palo Alto Traps: https://www.paloaltonetworks.com/products/endpoint-security.html

------------------------------------------------------------------------

Source: http://dl.packetstormsecurity.net/1503-exploits/pats-xss.txt

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...