Multiple vulnerabilities in osTicket.com osTicket



Published: 2017-10-16 | Updated: 2020-11-18
Risk High
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2019-13397
CVE-2017-15580
CVE-2017-15362
CWE-ID CWE-79
CWE-434
CWE-352
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Vulnerable software
Subscribe 		osTicket
Other software / Other software solutions

Vendor osTicket.com

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Cross-site scripting

EUVDB-ID: #VU35737

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-13397

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

osTicket: 1.10.1

CPE2.3 External links

http://medium.com/@sarapremashish/osticket-1-10-1-unauthenticated-stored-xss-allows-an-attacker-to-gain-admin-privileges-6a0348761a3a

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Arbitrary file upload

EUVDB-ID: #VU38020

Risk: High

CVSSv3.1:

CVE-ID: CVE-2017-15580

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content.

Mitigation

Install update from vendor's website.

Vulnerable software versions

osTicket: 1.10.1

CPE2.3 External links

http://0day.today/exploits/28864
http://nakedsecurity.com/cve/CVE-2017-15580/
http://becomepentester.blogspot.com/2017/10/osTicket-File-Upload-Restrictions-Bypassed-CVE-2017-15580.html
http://cxsecurity.com/issue/WLB-2017100187
http://packetstormsecurity.com/files/144747/osticket1101-shell.txt
http://www.cyber-security.ro/blog/2017/10/25/osticket-1-10-1-shell-upload/
http://www.exploit-db.com/exploits/45169/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Cross-site request forgery

EUVDB-ID: #VU38069

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2017-15362

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation

Install update from vendor's website.

Vulnerable software versions

osTicket: 1.10.1

CPE2.3 External links

http://becomepentester.blogspot.ae/2017/10/osTicket-XSS-CVE-2017-15362.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###