Vulnerability Note VU#763795

Netsweeper Internet Filter's WebAdmin Portal contains the following XSS, CSRF and SQLi vulnerabilities.

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2012-2446:
(1) The Netsweeper Internet Filter WebAdmin Portal is vulnerable to reflective XSS using the HTTP POST method to the /webadmin/tools/local_lookup.php?action=lookup function using the group parameter. The reflective XSS reported allows for information disclosure and arbitrary JavaScript code execution that can lead to the compromise of a user's account, machine, or other sensitive information.

CWE-352: Cross-Site Request Forgery (CSRF) CVE-2012-2447:
(2) The Netsweeper Internet Filter WebAdmin Portal is vulnerable to CSRF using the HTTP POST method in the /webadmin/accountmgr/adminupdate.php?act=add function. The CSRF reported allows for a breach in the content filtering system resulting in complete compromise of an organizations Internet content filter and control over users internet traffic.

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2012-3859
(3) The Netsweeper Internet Filter WebAdmin Portal is vulnerable to SQL injection, in the sortorder and sortitem variables. An example of a vulnerable url is http://SERVER_Hostname/webadmin/reporter/view_details.php?sortitem=report_date&sortorder=asc&type=demand&id=1441.

An attacker with access to the Netsweeper Internet Filter WebAdmin Portal web interface can conduct a cross-site scripting, cross-site request forgery, or sql injection attack, which could be used to result in information leakage, privilege escalation, and/or denial of service.

Update

The vendor has stated that these vulnerabilities have been addressed in Netsweeper version 3.0.6. Users are advised to upgrade to version 3.0.6 or higher.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS, CSRF, or SQLi attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing the Netsweeper Internet Filter WebAdmin Portal web interface using stolen credentials from a blocked network location.