Vulnerability Note VU#166739
APC Network Management Card web interface vulnerable to cross-site scripting and cross-site request forgery
The web management interface for the APC Network Monitoring Card (NMC) used in various APC devices contains cross-site scripting (XSS) and cross-site request forgery (CSRF/XSRF) vulnerabilities. By convincing a victim to load a specially crafted URL while authenticated to an NMC, an attacker could obtain credentials or perform certain actions as the victim, including turning off the NMC-based device and any systems attached to it.
Some APC uninterruptible power supplies (UPS) support remote network management using several types of Network Monitoring Card (NMC).
The NMC web management interface does not adequately filter user-supplied data before that data is included in dynamically generated web pages, creating cross-site scripting (XSS) vulnerabilities. One XSS vulnerability occurs in the /Forms/login1?login_username field (CVE-2009-4406). There may be other XSS vulnerabilities in the NMC web management interface (CVE-2009-1798).
By convincing a victim to load a specially crafted URL while authenticated to an NMC, an attacker could obtain user credentials or perform certain actions as that user. It is possible to exploit the XSS vulnerabilities to obtain cookies and other page content, so an attacker could obtain administrative credentials. If the attacker were able to access the NMC directly, the attacker would have complete control and could reconfigure the UPS or turn it off, thereby turning off any systems connected to the UPS. Exploiting the CSRF vulnerabilities could allow an attacker to take certain actions via the web interface, including turning off the UPS and any connected systems.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|American Power Conversion Corp.||Affected||-||24 Feb 2010|
CVSS Metrics (Learn More)
These vulnerabilities were researched and reported by Russ McRee. Jamal Pecou also reported CVE-2009-4406.
This document was written by Art Manion.
- CVE IDs: CVE-2009-1797 CVE-2009-1798 CVE-2009-4406
- Date Public: 14 Dec 2009
- Date First Published: 24 Feb 2010
- Date Last Updated: 29 Apr 2010
- Document Revision: 27
If you have feedback, comments, or additional information about this vulnerability, please send us email.