Cisco Ironport Cross Site Request Forgery / Cross Site Scripting

                							

                ===============================
                   - Advisory -
          ===============================

  Tittle:   Cisco IronPort Security Management Appliance - Multiple issues
    Risk:   Medium
    Date:   20.May.2013
  Author:   Pedro Andujar
 Twitter:   @pandujar

              
.: [ INTRO ] :.


The Cisco Security Management Appliance helps to enable flexible management and comprehensive security control 
at the network gateway. Is a central platform for managing all policy, reporting, and auditing information 
for Cisco web and email security appliances.


.: [ TECHNICAL DESCRIPTION ] :.

Cisco IronPort Security Management Appliance M170 v7.9.1-030 (and probably other products), are prone to several security issues 
as described below;


.: [ ISSUE #1 }:.

Name: Reflected Cross Site Scripting
Severity: Low 
CVE: CVE-2013-3396

There is a lack of output escaping in the default error 500 page. When a exception occurs in the application, the error
description contains user unvalidated input from the request:

** PoC removed as requested by Cisco. **


.: [ ISSUE #2 }:.

Name: Stored Cross Site Scripting
Severity: Medium

Due to a lack of input validation on job_name, job_type, appliances_options and config_master parameters which are then 
printed unscapped on job_name, old_job_name, job_type, appliance_lists and config_master fields.


** PoC removed as requested by Cisco. **


.: [ ISSUE #3 }:.

Name: CSRF Token is not used
Severity: Low
CVE: CVE-2013-3395

CSRFKey is not used in some areas of the application, which make even easier to exploit Reflected XSS Issues. In the /report area 
of the application, we got no error even when completely removing the parameter CSRFKey; 

** PoC removed as requested by Cisco. **

See: http://tools.cisco.com/security/center/viewAlert.x?alertId=29844

.: [ ISSUE #4 }:.

Name: Lack of password obfuscation
Severity: Low

When exporting the configuration file even if you mark the "mask password" option, the SNMPv3 password still appears in cleartext.


.: [ CHANGELOG ] :.

  * 20/May/2013:   - Vulnerability found.
  * 27/May/2013:   - Vendor contacted.
  * 11/Jul/2013:   - Public Disclosure


.: [ SOLUTIONS ] :.

Thanks to Stefano De Crescenzo (Cisco PSIRT Team), because of his professional way of managing the entire process.

Stored XSS
CSCuh24755

Reflected XSS
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3396

SNMP password issue
CSCuh27268, CSCuh70314

CSRF
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3395


.: [ REFERENCES ] :.

   [+] Cisco Content Security Management Appliance M170
    http://www.cisco.com/en/US/products/ps12503/index.html

   [+] Cisco Security Advisories
    http://tools.cisco.com/security/center/publicationListing.x

   [+] !dSR - Digital Security Research
    http://www.digitalsec.net/

   




                    -=EOF=-


<p>