CTERA - Persistent Cross-Site Scripting







# Exploit Title: [CTERA Project Folders -  Stored XSS]
# Date: [11-Mar-2013]
# Exploit Author: [Luigi Vezzoso]
# Vendor Homepage: [http://www.ctera.com]
# Version: [ and ]
# Tested on: [ctera os]
# CVE : [CVE-2013-2639]
Standard Ctera User can define a particular “description” for a ProjectFolder that cause javascript code execution and HTML injection. 
CTERA Networks (http://www.ctera.com)bridges the gap between cloud storage and local storage, providing optimized performance and end-to-end security. Our solutions accelerate deployment of cloud services and eliminate the costs associated with file servers, backup servers and tape drives. Service providers and enterprises use CTERA to deliver services such as backup, file sync and share, mobile collaboration, managed NAS and cloud on-ramping, based on the cloud infrastructure of their choice.
User can forge particular description on Project Folder that permit XSS, HTML Injection (add of link, images, button ecc). As the project folder can be shared with different users that vulnerability permit the grabbing of sessions cookies.
For test the vuln: Create a Project Folder with the following description (the particular path depend of firmware version)

</xml><img src="" onload="alert(document.cookie);">

Tested on CTERA Cloud Storage OS version and 
The vendor mark as resolved on latest CTERA version 4.x
Luigi Vezzoso 
email:  luigivezzoso@gmail.com
skype:  luigivezzoso