search menu icon-carat-right cmu-wordmark

CERT Coordination Center

SolarWinds Orion IPAM web interface reflected xss vulnerability

Vulnerability Note VU#203844

Original Release Date: 2012-10-31 | Last Revised: 2012-10-31

Overview

SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability.

Description

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. It has been reported that input fields are not sanitized allowing for authenticated users to execute scripts against the SolarWinds Orion IPAM web interface

Attack scenario:
1. http://[server name]/Orion/IPAM/IPAMSummaryView.aspx
2. Enter the following in the "Search for an IP address" field: "></script><script>alert('hi')</script>
3. Click Search, which will redirect you to the following URL:http://[server name]/Orion/IPAM/search.aspx?q=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%27hi%27%29%3C%2Fscript%3E

Impact

An attacker with access to the SolarWinds Orion IPAM web interface can conduct a reflected cross-site scripting attack, which could be used to result in information leakage, privilege escalation, and/or denial of service.

Solution

Apply Hotfix

The vendor has stated this vulnerability has been addressed in IPAM-v3.0-HotFix1. Users are advised to apply the hotfix. The vendor has stated this hotfix will be incorporated in the next version of IPAM v3.1, due this quarter and that customers under maintenance can get access to this hot fix via their SolarWinds Customer Portal.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS, CSRF, or SQLi attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing the SolarWinds Orion IPAM web interface using stolen credentials from a blocked network location.

Vendor Information

203844
 
Affected   Unknown   Unaffected

SOLARWINDS

Notified:  August 02, 2012 Updated:  October 31, 2012

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.


CVSS Metrics

Group Score Vector
Base 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N
Temporal 2.7 E:POC/RL:W/RC:UC
Environmental 0.9 CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Anthony Trummer for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs: CVE-2012-4939
Date Public: 2012-10-31
Date First Published: 2012-10-31
Date Last Updated: 2012-10-31 14:32 UTC
Document Revision: 10

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.