Document Title:
===============
Direct Admin v1.50.0 - CS Cross Site Scripting Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1824
Release Date:
=============
2016-04-14
Vulnerability Laboratory ID (VL-ID):
====================================
1824
Common Vulnerability Scoring System:
====================================
3.3
Product & Service Introduction:
===============================
DirectAdmin is a graphical web-based web hosting control panel designed to make administration of websites easier.
DirectAdmin is often called DA for short. DirectAdmin is compatible with several versions of Red Hat, Fedora Core,
Red Hat Enterprise Linux, CentOS, FreeBSD, Ubuntu and Debian.
(Copy of the Homepage: https://en.wikipedia.org/wiki/DirectAdmin )
Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered multiple client-side cross site scripting vulnerabilities in the official Direct Admin v1.50.0 hosting panel web-application.
Vulnerability Disclosure Timeline:
==================================
2016-04-15: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
JBMC Software
Product: Direct Admin - Hosting Panel (Web-Application 1.50.0
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Low
Technical Details & Description:
================================
Multiple client-side cross site scripting vulnerabilities has been discovered in the official Direct Admin v1.5 Hosting Panel web-application.
The client-side issue allows remote attackers to inject own malicious script code with non-persistent attack vector to compromise browser to
web-application requests.
The vulnerability is located in the `select1` and `delete` values of the `CMD_SELECT_USERS` module GET method request. Remote attackers are able
to inject own malicious script code to the client-side of the vulnerable module. The request method to inject is GET and the attack vector of the
issue is non-persistent. The vulnerability is a classic client-side cross site scripting vulnerability.
The security risk of the client-side cross site vulnerabilities are estimated as medium with a cvss (common vulnerability scoring system) count of 3.3.
Exploitation of the non-persistent input validation vulnerabilities requires no privileged web-application user account and low or medium user interaction.
Successful exploitation of the vulnerability results in session hijacking, non-persistent phishing attacks, non-persistent external redirects to malicious
source and non-persistent manipulation of affected or connected application modules.
Request Method(s):
[+] GET
Vulnerable Module(s):
[+] CMD_SELECT_USERS
Vulnerable Parameter(s):
[+] select1
[+] delete
Proof of Concept (PoC):
=======================
The client-side cross site scripting web vulnerabilities can be exploited by remote attackers without privileged user account and with low or medium user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
PoC: Example
https://localhost:2222/CMD_SELECT_USERS?select1=Site[CLIENT-SIDE CROSS SITE SCRIPTING VULNERABILITY!]&reason=none&delete=Delete&location=CMD_ALL_USER_SHOW
https://localhost:2222/CMD_SELECT_USERS?delete=%3C[CLIENT-SIDE CROSS SITE SCRIPTING VULNERABILITY!]%3EDelete&location=CMD_ALL_USER_SHOW&reason=none&
PoC: Exploitation
https://localhost:2222/CMD_SELECT_USERS?select1=Site'">&reason=none&delete=Delete&location=CMD_ALL_USER_SHOW
https://localhost:2222/CMD_SELECT_USERS?delete=%3Ciframe%3EDelete&location=CMD_ALL_USER_SHOW&reason=none&select1=Site%3Ca+
onmouseover%3Dhttp%3A%2F%2Fwww.google.de+%3Ch%3Exxs+link%3Ca%3E%3Ciframe+src%3D%22http%3A%2F%2Fwww.google.de%22+onload%3Dalert%28document.cookie%29%3E&
comparison1=none&value1=%22%3E%3Ciframe%3E&sort1dir=1&sort1=1&sort2dir=1&ipp=10
PoC: Vulnerable Source (./CMD_SELECT_USERS?delete=)