TITLE:
WhatsUp Professional Cross-Site Scripting and Information Disclosure

SECUNIA ADVISORY ID:
SA20075

VERIFY ADVISORY:
http://secunia.com/advisories/20075/

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting

WHERE:
>From remote

SOFTWARE:
Ipswitch WhatsUp Professional 2006
http://secunia.com/product/9917/
Ipswitch WhatsUp Professional 2006 Premium
http://secunia.com/product/9918/

DESCRIPTION:
Some vulnerabilities and weaknesses have been discovered in WhatsUp
Professional, which can be exploited by malicious people to gain
knowledge of certain information or conduct cross-site scripting
attacks.

1) Input passed to NmConsole/Navigation.asp and to the "sHostname"
parameter in NmConsole/ToolResults.asp is not properly sanitised
before being returned to users. This can be exploited to execute
arbitrary HTML and script code in a logged in user's browser session
in context of a vulnerable site.

Example:
http://[host]:8022/NmConsole/Navigation.asp?">[code]

2) Input passed to NmConsole/Tools.asp and
NmConsole/DeviceSelection.asp is also not properly sanitised before
being returned to users. This can be exploited to execute arbitrary
HTML and script code in a logged in user's browser session in context
of a vulnerable site.

3) It's possible to disclose monitored devices without being logged
in by passing arbitrary values to the "nDeviceGroupID" parameter in
"NmConsole/utility/RenderMap.asp".

Example:
http://[host]:8022/NmConsole/utility/RenderMap.asp?nDeviceGroupID=2

4) Input passed to the "sRedirectUrl" and "sCancelURL" in
NmConsole/DeviceSelection.asp is not properly verified, which makes
it possible to redirect a user to an arbitrary web site.

It is also possible to disclose the source code of the ASP pages by
appending a period to the end of the file extension.

5) Different error messages are returned during login to
"NmConsole/Login.asp" depending on whether the supplied username or
password is incorrect.

6) It is possible to disclose path information in 404 error messages
returned by the service.

Example:
http://[host]:8022/NmConsole

The vulnerabilities and weaknesses have been confirmed in WhatsUp
Professional 2006.

SOLUTION:
Restrict access to port 8022/tcp and don't visit other web sites
while logged in.

PROVIDED AND/OR DISCOVERED BY:
1, 3, 4) David Maciejak
2, 5, 6) Reported by an anonymous person.

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------