The web management interface for the APC Network Monitoring Card (NMC) used in various APC devices contains cross-site scripting (XSS) and cross-site request forgery (CSRF/XSRF) vulnerabilities. By convincing a victim to load a specially crafted URL while authenticated to an NMC, an attacker could obtain credentials or perform certain actions as the victim, including turning off the NMC-based device and any systems attached to it.
Some APC uninterruptible power supplies (UPS) support remote network management using several types of Network Monitoring Card (NMC).
The NMC web management interface does not adequately filter user-supplied data before that data is included in dynamically generated web pages, creating cross-site scripting (XSS) vulnerabilities. One XSS vulnerability occurs in the /Forms/login1?login_username field (CVE-2009-4406). There may be other XSS vulnerabilities in the NMC web management interface (CVE-2009-1798).
By convincing a victim to load a specially crafted URL while authenticated to an NMC, an attacker could obtain user credentials or perform certain actions as that user. It is possible to exploit the XSS vulnerabilities to obtain cookies and other page content, so an attacker could obtain administrative credentials. If the attacker were able to access the NMC directly, the attacker would have complete control and could reconfigure the UPS or turn it off, thereby turning off any systems connected to the UPS. Exploiting the CSRF vulnerabilities could allow an attacker to take certain actions via the web interface, including turning off the UPS and any connected systems.
These vulnerabilities were researched and reported by Russ McRee. Jamal Pecou also reported CVE-2009-4406.
This document was written by Art Manion.