Amethyst Cross Site Scripting and Request Forgery Vulnerabilities


Description   Multiple vulnerabilities have been identified in Amethyst, which could be exploited to conduct cross-site scripting and request forgery attacks. These issues are caused by input validation errors in the administrative interface when processing HTTP requests and user-supplied parameters, which could be exploited by attackers to manipulate certain data (e.g. modify the administrative password) by tricking an administrator into visiting a malicious web page, or execute arbitrary scripting code.
     
Vulnerable Products   Vulnerable Software:
Amethyst version 0.1.5 and prior
     
Solution  
     
CVE  
     
References   http://www.htbridge.ch/advisory/xsrf_csrf_in_amethyst.html
http://www.htbridge.ch/advisory/xss_vulnerability_in_amethyst_1.html
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
XSS - Prevention - POST : suspicious tag with event found in data
3.2.0
XSS - Prevention - POST : suspicious 'object' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'applet' tag found in data
3.2.0
XSS - Prevention - POST : 'location' javascript object found in data
3.2.0
XSS - Prevention - POST : javascript code found in data
3.2.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data
3.2.0
XSS - Prevention - POST : code allowing cookie access found in data
3.2.0
XSS - Prevention - POST : suspicious 'embed' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'div' tag found in data
3.2.0
XSS - Prevention - POST : 'script' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'style' attribute found in data
3.2.0
     


 
 
 
 
 Risk level 
Low 

 Vulnerability First Public Report Date 
2010-08-06 

 Target Type 
Client 

 Possible exploit 
Local & Remote