Cisco IOS HTTP Server HTML Injection and Cross Site Scripting Issues


Description   Two vulnerabilities were identified in Cisco IOS, which could be exploited by attackers to inject malicious HTML code.
The fisrt flaw is due to an input validation error in the "show" commands of the HTTP Server that do not properly validate certain data before being displayed in the web interface, which may be exploited by remote attackers to inject malicious HTML code that will execute arbitrary commands on the device (e.g. change the "ENABLE" password), including the possibility of gaining full administrative privileges on the device which is dependent on the privilege level of the authenticated user.
The second vulnerability is due to an input validation error in the web administration server package when processing and displaying CDP (Cisco Discovery Protocol) packets in the CDP status page, which could be exploited by attackers to execute arbitrary scripting code.
     
Vulnerable Products   Vulnerable Software:
Cisco IOS versions 11.0 through 12.4
     
Solution  
     
CVE   CVE-2005-3921
     
References   http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml
http://www.infohacking.com/INFOHACKING_RESEARCH/Our_Advisories/cisco/index.html
http://www.frsirt.com/english/reference/4657
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious tag with event found in data
3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL
3.2.0
XSS - Prevention - GET : javascript code in flash clickTAG parameter
3.2.0
XSS - Prevention - POST : suspicious 'object' tag found in data
3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious 'applet' tag found in data
3.2.0
XSS - Prevention - POST : 'location' javascript object found in data
3.2.0
XSS - Phishing : suspicious 'div' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL
3.2.0
XSS - Prevention - POST : javascript code found in data
3.2.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data
3.2.0
XSS - Prevention - POST : code allowing cookie access found in data
3.2.0
XSS - Phishing : suspicious 'a' tag found in URL
3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL
3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL
3.2.0
XSS - Phishing : suspicious 'form' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious 'embed' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data
3.2.0
XSS - Prevention - GET : javascript code found in URL
3.2.0
XSS - Prevention - GET : 'script' tag in flash clickTAG parameter
3.2.0
XSS - Prevention - POST : suspicious 'div' tag found in data
3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL
3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL
3.2.0
XSS - Phishing : suspicious 'link' tag found in URL
3.2.0
XSS - Prevention - GET : 'script' tag found in URL
3.2.0
XSS - Prevention - POST : 'script' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'style' attribute found in data
3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL
3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL
3.2.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2005-11-29 

 Target Type 
Server 

 Possible exploit 
Local & Remote