Vulnerability Note VU#203844

SolarWinds Orion IPAM web interface reflected xss vulnerability

Original Release date: 31 Oct 2012 | Last revised: 31 Oct 2012

Overview

SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability.

Description

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. It has been reported that input fields are not sanitized allowing for authenticated users to execute scripts against the SolarWinds Orion IPAM web interface

    Attack scenario:
    1. http://[server name]/Orion/IPAM/IPAMSummaryView.aspx
    2. Enter the following in the "Search for an IP address" field: "></script><script>alert('hi')</script>
    3. Click Search, which will redirect you to the following URL:http://[server name]/Orion/IPAM/search.aspx?q=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%27hi%27%29%3C%2Fscript%3E

Impact

An attacker with access to the SolarWinds Orion IPAM web interface can conduct a reflected cross-site scripting attack, which could be used to result in information leakage, privilege escalation, and/or denial of service.

Solution

Apply Hotfix
The vendor has stated this vulnerability has been addressed in IPAM-v3.0-HotFix1. Users are advised to apply the hotfix. The vendor has stated this hotfix will be incorporated in the next version of IPAM v3.1, due this quarter and that customers under maintenance can get access to this hot fix via their SolarWinds Customer Portal.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS, CSRF, or SQLi attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing the SolarWinds Orion IPAM web interface using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
SOLARWINDSAffected02 Aug 201231 Oct 2012
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N
Temporal 2.7 E:POC/RL:W/RC:UC
Environmental 0.9 CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Anthony Trummer for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

  • CVE IDs: CVE-2012-4939
  • Date Public: 31 Oct 2012
  • Date First Published: 31 Oct 2012
  • Date Last Updated: 31 Oct 2012
  • Document Revision: 10

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.