CERT-In Vulnerability Note CIVN-2007-149
CiscoWorks Server XSS Vulnerability

Original Issue Date: December 11, 2007

Severity Rating: Medium


Systems Affected

• CiscoWorks Common Services 3.0.x
• CiscoWorks Common Services 3.1
  
  Both windows and Solaris Platforms

Overview

CiscoWorks is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Description

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users. This vulnerability can be exploited by attackers to bypass access controls.

Cisco-Works is a network monitoring tool which and it works with all kind of Cisco devices. It is vulnerable to Cross Site Scripting (XSS) attacks from the Cisco-Works Server login page, http:// server-name : portnumber . When this XSS vulnerability is exploited, malicious code or script is embedded within the URL and associated with an unsuccessful login attempt page. An attacker could try to convince an unsuspecting user to follow a malicious link created by an embedded malicious code to a vulnerable Cisco-Works server that injects (reflects) the malicious code into the user's browser.

Solution

Apply appropriate patches provided by Cisco. The patches are available for registered customers at:

http://www.cisco.com/cgi-bin/tablebuild.pl/cw2000-cd-one

Vendor Information

Cisco
http://www.cisco.com/warp/public/707/cisco-sr-20071205-cw.shtml

References

Liquid Matrix
http://www.liquidmatrix.org/blog/2007/12/05/advisory-cross-site-scripting-in-ciscoworks/

CSIRTUK
http://www.cpni.gov.uk/Products/alerts/3510.aspx

Secunia
http://secunia.com/advisories/27902/

SecurityLab
http://en.securitylab.ru/notification/309456.php

AusCert
https://www.auscert.org.au/render.html?it=8460

SecurityFocus
http://www.securityfocus.com/bid/26708

Cisco
http://www.cisco.com/warp/public/707/cisco-amb-20060922-understanding-xss.shtml

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Communications and Information Technology
Electronics Niketan
6, C.G.O. Complex
New Delhi-110 003