source: https://www.securityfocus.com/bid/50456/info
Hyperic HQ Enterprise is prone to a cross-site scripting vulnerability and multiple unspecified security vulnerabilities.
An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials. The impact of other issues is unknown.
These issues affect Hyperic HQ Enterprise 4.5.1; other versions may also be affected.
Proof of Concept:
=================
The vulnerabilities can be exploited by remote attackers or local & low privileged user accounts.
For demonstration or reproduce ...
1.1
Code Review: HQ Roles [IVE - Persistent]
|
|
| Dashboard Name: |
New Role Dashboard |
|
|
Code Review: java.security.krb5.kdc Module: HQ Health / HQ Process Information & Diagnostics [IVE - Persistent]
- java.rmi.server.codebase = http://h1461735:9093/
- java.rmi.server.hostname = h1461735
- java.runtime.name = Java(TM) SE Runtime Environment
- java.runtime.version = 1.6.0_13-b03
- java.security.krb5.kdc = >"
- java.security.krb5.realm = >"
- java.specification.name = Java Platform API Specification
- java.specification.vendor = Sun Microsystems Inc.
- java.specification.version = 1.6
- java.vendor = Sun Microsystems Inc.
.../PoC/printReport(poc).hqu
Code Review: Browse - Monitor - Indikators [IVE - Persistent]
hyperic.data.escalation.pauseSelect.options[12] = new Option("72 hours", "259200000");
hyperic.data.escalation.pauseSelect.options[13] = new Option("Until Fixed", "9223372036854775807");
HQ View Application Monitor Current Health - >"<INCLUDE/EXECUTE PERSISTENT SCRIPT CODE HERE!!!>
>"<INCLUDE/EXECUTE PERSISTENT SCRIPT CODE HERE!!!>