Document Title:
===============
WebTitan v 3.62 - Multiple Cross Site Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=589
Release Date:
=============
2012-06-19
Vulnerability Laboratory ID (VL-ID):
====================================
589
Common Vulnerability Scoring System:
====================================
3.5
Product & Service Introduction:
===============================
WebTitan is a complete internet monitoring software (web filter) which provides organisations protection for their data from malware
and other internet threats such as viruses, spyware and phishing as well as providing user policy browsing tools to ensure corporate
internet policy is adhered to. Feature Set ...
* Includes proxy server and cache
* URL Filtering – 53 predefined categories, customizable category creation
* Granular policy engine based on users and groups
* Content control
* Application controls
* Includes Anti-virus Protection
* Simple download and installation process
* Plug and Play solution
* Highly Effective web filtering capabilities
* ISO and VMware® options
* Easy to set up - Up and running in 30 minutes
* Web based administrative GUI
* Multiple automated reports for entire user activity
* Automated updating including URL filters, anti-virus, version releases and system backup
* LDAP integration
(Copy of the Vendor Website: http://www.webtitan.com/products)
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple cross site scripting vulnerabilities in WebTitan v3.62
Vulnerability Disclosure Timeline:
==================================
2012-06-01: Researcher Notification & Coordination
2012-06-03: Vendor Notification
2012-06-05: Vendor Response/Feedback
2012-06-20: Public or Non-Public Disclosure
Discovery Status:
=================
Published
Affected Product(s):
====================
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Low
Technical Details & Description:
================================
Multiple input validation vulnerabilities are detected in WebTitan v3.62 web filtering appliance.
The bugs allow remote attackers to implement/inject malicious script code on the application-side.
Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable
context manipulation. Exploitation requires low user inter action & low or medium privileged user account.
The vulnerabilities are located in the proxy.php, reporting.php, schedulereports.php or the updates.php
& the bound vulnerable parameters add domain, filter name, report name & version.
Vulnerable Module(s):
[+] Upstream Proxy - Selected domains: add
[+] Choose report by filter - create a filter - [Filter name] [Users]
[+] Edit a report [send to] - [Report Name]
[+] Click on release note- intercept the post request and change the value version=
Vulnerable Files(s):
[+] proxy.php
[+] reporting.php
[+] scheduledreports.php
[+] updates.php
Vulnerable Parameter(s):
[+] domain - add
[+] filter name
[+] report name
[+] version
Proof of Concept (PoC):
=======================
The persistent vulnerabilities can be exploited by local low privileged user account & low user inter action. For demonstration or reproduce ...
1.
Proxy - Upstream Proxy - Selected domains: add
PoC:
URL: http://webtitan.127.0.0.1:1337/proxy.php
---------------------------------------------------------------------------------------------------
2.
Reporting - reports - choose report by filter - create a filter - [Filter name] [Users]
PoC: ">