Vulnerability Note VU#166739

APC Network Management Card web interface vulnerable to cross-site scripting and cross-site request forgery

Original Release date: 24 Feb 2010 | Last revised: 29 Apr 2010

Overview

The web management interface for the APC Network Monitoring Card (NMC) used in various APC devices contains cross-site scripting (XSS) and cross-site request forgery (CSRF/XSRF) vulnerabilities. By convincing a victim to load a specially crafted URL while authenticated to an NMC, an attacker could obtain credentials or perform certain actions as the victim, including turning off the NMC-based device and any systems attached to it.

Description

Some APC uninterruptible power supplies (UPS) support remote network management using several types of Network Monitoring Card (NMC).

The NMC web management interface does not adequately filter user-supplied data before that data is included in dynamically generated web pages, creating cross-site scripting (XSS) vulnerabilities. One XSS vulnerability occurs in the /Forms/login1?login_username field (CVE-2009-4406). There may be other XSS vulnerabilities in the NMC web management interface (CVE-2009-1798).

The web interface also fails to adequately authenticate some requests, creating cross-site request forgery (CSRF/XSRF) vulnerabilities (CVE-2009-1797).

Impact

By convincing a victim to load a specially crafted URL while authenticated to an NMC, an attacker could obtain user credentials or perform certain actions as that user. It is possible to exploit the XSS vulnerabilities to obtain cookies and other page content, so an attacker could obtain administrative credentials. If the attacker were able to access the NMC directly, the attacker would have complete control and could reconfigure the UPS or turn it off, thereby turning off any systems connected to the UPS. Exploiting the CSRF vulnerabilities could allow an attacker to take certain actions via the web interface, including turning off the UPS and any connected systems.

Solution


Update firmware

Update NMC firmware as specified by APC. Release notes indicate that these vulnerabilities are addressed in firmware version 3.7.2 for certain NMCs. APC has indicated that the vulnerabilities are also addressed in firmware version 5.1.1.


Disable web interface

Disabling the web management interface will prevent exploitation of these vulnerabilities.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Consider setting up management networks as separate and dedicated channels. Note that restricting access does not prevent XSS or CSRF attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing an NMC using stolen credentials from a blocked network location.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
American Power Conversion Corp.Affected-24 Feb 2010
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

These vulnerabilities were researched and reported by Russ McRee. Jamal Pecou also reported CVE-2009-4406.

This document was written by Art Manion.

Other Information

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.