SolarWinds Orion IPAM web interface reflected xss vulnerability
Vulnerability Note VU#203844
Original Release Date: 2012-10-31 | Last Revised: 2012-10-31
Overview
SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability.
Description
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
SolarWinds Orion IPAM web interface contains a reflected cross-site scripting vulnerability. It has been reported that input fields are not sanitized allowing for authenticated users to execute scripts against the SolarWinds Orion IPAM web interface
Attack scenario: 1. http://[server name]/Orion/IPAM/IPAMSummaryView.aspx 2. Enter the following in the "Search for an IP address" field: "></script><script>alert('hi')</script> 3. Click Search, which will redirect you to the following URL:http://[server name]/Orion/IPAM/search.aspx?q=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%27hi%27%29%3C%2Fscript%3E
Impact
An attacker with access to the SolarWinds Orion IPAM web interface can conduct a reflected cross-site scripting attack, which could be used to result in information leakage, privilege escalation, and/or denial of service.
Solution
Apply Hotfix
The vendor has stated this vulnerability has been addressed in IPAM-v3.0-HotFix1. Users are advised to apply the hotfix. The vendor has stated this hotfix will be incorporated in the next version of IPAM v3.1, due this quarter and that customers under maintenance can get access to this hot fix via their SolarWinds Customer Portal.
Restrict access
As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS, CSRF, or SQLi attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing the SolarWinds Orion IPAM web interface using stolen credentials from a blocked network location.