[FD] ClearPass Policy Manager Stored XSS

=============================================================================== title: ClearPass Policy Manager Stored XSS case id: CM-2014-01 product: Aruba ClearPass Policy Manager vulnerability type: Stored cross-site script severity: Medium found: 2014-11-24 by: Cristiano Maruti (@cmaruti) =============================================================================== [EXECUTIVE SUMMARY] The analysis discovered a stored cross site scripting vulnerability (OWASP OTG-INPVAL-002) in the ClearPass Policy Manager. A malicious unauthenticated user is able to inject arbitrary script through the login form that may be rendered and triggered later if a privileged authenticated user reviews the access audit record. An attack can use the aforementioned vulnerability to effectively steal session cookies of privileged logged on users. [VULNERABLE VERSIONS] The following version of the Aruba ClearPass Policy Manager was affected by the vulnerability; previous versions may be vulnerable as well: - Aruba ClearPass Policy Manager 6.4 [TECHNICAL DETAILS] It is possible to reproduce the vulnerability following these steps: 1. Open the login page with your browser; 2. Put the "><" string in the username field and fill in the password field with a value of your choice; 3. Submit the form; 4. Login to the application with an administrative user: 5. Go to "Monitoring -> Live monitoring -> Access tracker" to raise the payload. Below a full transcript of the HTTP request used to raise the vulnerability HTTP Request

Source: Gmail -> IFTTT-> Blogger