Permanent XSS:
Advisory Name: Permanent Cross-Site Scripting (XSS) in Hipergate 4.0.12
Vulnerability Class: Permanent Cross-Site Scripting (XSS)
Release Date: 2010-02-02
Affected Applications: Confirmed in Hipergate 4.0.12. Other versions may also be affected
Affected Platforms: Multiple
Local / Remote: Remote
Severity: Medium – CVSS: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Researcher: Nahuel Grisolía
Vendor Status: Still Vulnerable – No Patch Available at the moment
Vulnerability Description:
A permanent Cross Site Scripting vulnerability was found in Hipergate 4.0.12, because the application
fails to sanitize user-supplied input. Any logged-in user who is able to add a New Campaign can trigger
the vulnerability.
Proof of Concept:
* Add <script>alert(“XSS in Campaign”);</script> as a new campaign.
Impact:
An affected user may unintentionally execute scripts or actions written by an attacker. In addition, an
attacker may obtain authorization cookies that would allow him to gain unauthorized access to the
application.
Solution: Maybe in Build 5.5 (Future Release, information provided by the vendor)
Vendor Response: Last Contact on January 12, 2010. They said that no more patches would be
provided since Build 5.5 will be released soon.
Contact Information:
For more information regarding the vulnerability feel free to contact the researcher at
nahuel.grisolia <at> gmail <dot> com
Reflected XSS:
Advisory Name: Reflected Cross-Site Scripting (XSS) in Hipergate
Vulnerability Class: Reflected Cross-Site Scripting (XSS)
Release Date: 2010-02-02
Affected Applications: Confirmed in Hipergate 4.0.12. Other versions may also be affected
Affected Platforms: Multiple
Local / Remote: Remote
Severity: Medium – CVSS: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Researcher: Nahuel Grisolía
Vendor Status: Still Vulnerable – No Patch Available at the moment
Vulnerability Description:
A reflected Cross Site Scripting vulnerability was found in Hipergate 4.0.12, because the application
fails to sanitize user-supplied input. Any logged-in user can trigger the vulnerability.
Proof of Concept:
http://x.x.x.x:8080/hipergate/common/errmsg.jsp?title=%3Cscript%3Ealert%28%22titleXSS%22%29;
%3C/script%3E&desc=%3Cscript%3Ealert%28%22descXSS%22%29;%3C/script%3E&resume=_bac
k
Script pwd_errmsg.jsp is also affected.
Impact:
An affected user may unintentionally execute scripts or actions written by an attacker. In addition, an
attacker may obtain authorization cookies that would allow him to gain unauthorized access to the
application.
Solution: Maybe in Build 5.5 (Future Release, information provided by the vendor)
Vendor Response: Last Contact on January 12, 2010. They said that no more patches would be
provided since Build 5.5 will be released soon.
Contact Information:
For more information regarding the vulnerability feel free to contact the researcher at
nahuel.grisolia <at> gmail <dot> com
SQL Command Exec:
Advisory Name: SQL Command Exec in Hipergate
Vulnerability Class: SQL Command Exec
Release Date: 2010-02-02
Affected Applications: Confirmed in Hipergate 4.0.12. Other versions may also be affected.
Affected Platforms: Multiple
Local / Remote: Remote
Severity: High – CVSS: 10 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Researcher: Nahuel Grisolía
Vendor Status: Still Vulnerable – No Patch Available at the moment
Vulnerability Description:
A vulnerability has been discovered in Hipergate, which can be exploited by malicious people to
conduct SQL Command Execution Attacks.
The vulnerability is confirmed in version 4.0.12. Other versions may also be affected.
Proof of Concept:
http://x.x.x.x:8080/hipergate/admin/sql.htm
Impact: Execute arbitrary SQL queries.
Solution: Maybe in Build 5.5 (Future Release, information provided by the vendor)
Vendor Response: Last Contact on January 12, 2010. They said that no more patches would be
provided since Build 5.5 will be released soon.
Contact Information:
For more information regarding the vulnerability feel free to contact the researcher at
nahuel.grisolia <at> gmail <dot> com
