============================================INTERNET SECURITY AUDITORS ALERT 2006-007
- Original release date: April 27, 2006
- Last revised: December 1, 2006
- Discovered by: Jesus Olmos Gonzalez
- Severity: 2/5
============================================
I. VULNERABILITY
-------------------------
The BlueSocket web administration is vulnerable to a Cross Site
Scripting attack.

II. BACKGROUND
-------------------------
BSC 2100 product is included in the Blue Secure Family
(www.bluesocket.com) 

BlueSecure Controllers provide high-performance, reliable,
policy-based WLAN security and management solutions that have been
deployed by hundreds of large institutions, enterprises, and public
access providers.

III. DESCRIPTION
-------------------------
The admin.pl perl code don't sanitize the imputs and then wen it tries
to rewrite the username at the input, html + script code could be
rewrited and executed by the browser.

This crossite is in the administration of the security product, it has
been tested only in BSC 2100.

Is it possible to send a fake email to the admin spoofing the product
address, saying that the configuration is not ok and sending the
special link.

If the admin press the link and validate in aparently normal
interface, his credentials will be sended to the attacker.

If this is done with a good social engineering will be a great risk.

IV. PROOF OF CONCEPT
-------------------------
This POC will inject some html to modify the look and feel of the
authentication, and attacker could inject script code to send
credentials to him.

https://somehost.somedomain.org/admin.pl?ad_name=%22%3E%3Ch1%3EXSS%20BUG%3C/h1%3E%3C!--

V. BUSINESS IMPACT
-------------------------
Credentials could be stolen due social engineering attacks.

VI. SYSTEMS AFFECTED
-------------------------
Versions prior 5.2 or without 5.1.1-BluePatch

VII. SOLUTION
-------------------------
Update to 5.2 version or apply 5.1.1-BluePatch

VIII. REFERENCES
-------------------------
Vulnerability item number 4484 in the Bluepatch V6 for 5.1.1.1 Release
Notes.

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported by
Jesus Olmos Gonzalez (jolmos (at) isecauditors (dot) com).

X. REVISION HISTORY
-------------------------
April     27, 2006: Initial vendor contact.
April     28, 2006: Vendor updates its near patch.
June      21, 2006: Publication of the patch.
September 16, 2006: Vendor confirms inclusion in referenced patch.
September 17, 2006: Advisory revised.

XI. DISCLOSURE TIMELINE
-------------------------
April     26, 2006: The vulnerability discovered by
                    Internet Security Auditors.
December   1, 2006: Advisory finally Published

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
Internet Security Auditors, S.L. accepts no responsibility for any
damage caused by the use or misuse of this information.