{"id":542,"date":"2012-04-20T10:34:48","date_gmt":"2012-04-20T16:34:48","guid":{"rendered":"http:\/\/www.foofus.net\/?page_id=542"},"modified":"2012-04-20T10:34:48","modified_gmt":"2012-04-20T16:34:48","slug":"xss-in-kaseya-version-6-2-0-0-web-interface","status":"publish","type":"page","link":"http:\/\/h.foofus.net\/?page_id=542","title":{"rendered":"XSS in Kaseya version 6.2.0.0 web interface"},"content":{"rendered":"


\n1. Summary<\/code><\/p>\n

The Kaseya version 6.2.0.0 web interface (and possibly other versions) is vulnerable to Cross-Site Scripting in the “adminName” variable.<\/p>\n

2. Description<\/p>\n

By submitting malicious input such as the following, it is possible to render javascript in the security context of the Kaseya server:<\/p>\n

“><sCrIpT>alert(83212)<\/sCrIpT><\/p>\n

3. Proof of Concept<\/p>\n

Use a HTML proxy such as WebScarab or Burp to intercept the HTML form post as it is submitted, and replace the “adminName” with the input above.<\/p>\n

4. Impact<\/p>\n

Arbitrary JavaScript code may be executed in the security context of the Kaseya web server.<\/p>\n

5. Affected Products<\/p>\n

“System Version 6.2.0.0” (from information pane of affected web server) and possibly others.<\/p>\n

6. Solution<\/p>\n

Upgrade to the latest version. According to Kaseya, “The fix was actually deployed with hotfix #1686, Files Released to VSAUpdate, batch 499 on 1\/30\/2012 6:16:06 PM”<\/p>\n

7. Timetable<\/p>\n

2011-11-11 Advisory Written. Vendor notified via web form and e-mail.
\n2012-01-31 Vendor acknowledges flaw.
\n2012-02-27 Vendor notifies of available fix.
\n2012-03-01 Attempt to coordinate release of information with vendor
\n2012-04-20 Published<\/p>\n

8. Reference<\/p>\n

(to be determined)<\/p>\n

9. Credits<\/p>\n

bede@foofus.net (Mark Lachniet)<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

1. Summary The Kaseya version 6.2.0.0 web interface (and possibly other versions) is vulnerable to Cross-Site Scripting in the “adminName” variable. 2. Description By submitting malicious input such as the following, it is possible to render javascript in the security context of the Kaseya server: “><sCrIpT>alert(83212)<\/sCrIpT> 3. Proof of Concept Use a HTML proxy such […]<\/p>\n","protected":false},"author":8,"featured_media":0,"parent":273,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-542","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages\/542","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=542"}],"version-history":[{"count":0,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages\/542\/revisions"}],"up":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/pages\/273"}],"wp:attachment":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=542"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}