Trustwave SpiderLabs Security Advisory TWSL2024-002: Multiple Cross-Site
Scripting Vulnerabilities in The OptimalCloud IAM Platform

Published: 07/12/2024 
Version: 1.0

Vendor: Optimalidm (https://optimalidm.com/)
Product: The OptimalCloud
Version affected: N/A

Product description: The OptimalCloud from Optimal IdM is a scalable and
affordable Identity and Access Management (IAM) solution built for the security
and usability needs of small, mid-sized and enterprise organizations.

Finding 1: Persistent Cross-Site Scripting (DOM based)
*****Credit: Jean Calvin Mugabo of Trustwave
CWE: CWE-79

- Vulnerability Overview: The feature for adding Multi-factor Authentication
(MFA) devices is vulnerable to Cross-Site Scripting (XSS).

- Location of Vulnerability: - Path: Home Portal > Account Settings >
Multi-Factor Token/Device Options > MFA Device/Token Management > Add
Token/Device. - Description: The form at the specified location does not
properly validate user inputs, allowing the submission of JavaScript code.

- Evidence of Vulnerability: - Details: Spiderlabs added an MFA device
containing the following JavaScript code: `<iframe
src="javascript:alert('Spiderlabs-xss')">`. - Execution Location: The injected
JavaScript executes in the admin area at the following location: Home Portal >
Identity Management > User Manager > Action > Edit > User Details > MFA Devices.

----------

Details about the vulnerable javascript code:

The XSS vulnerability lies in how the DataTables plugin handles and renders the
data coming from the server, particularly the sName field of the MFA device
names. There is the following definition in the aoColumnDefs array.

{ "mData": "sName", "width": "25%", "aTargets": [3] }

The sName field is specified to be rendered directly without sanitisation.
Since the content of sName is <iframe
src="javascript:alert('Spiderlabs-xss')">, this script will execute when
rendered, resulting in an XSS attack.

Full HTTP requests and screenshots demonstrating the vulnerability have been
added to the evidence.docx file. ----------

Finding 2: Reflected Cross-Site Scripting (XSS)
*****Credit: Jean Calvin Mugabo of Trustwave
CWE: CWE-79

The OPTIMAL AI 403 page is vulnerable to reflected cross-site scripting (XSS).
When an XSS payload is provided within the SessionId cookie value, the payload
is reflected in the response unsanitized.

The below payload was submitted in the ASP.NET_SessionId cookie value.

Cookie: ASP.NET_SessionId=xrz30o0wkdayadqrpxoff3tu<script>alert(1)</script>;

The payload was reflected in the response.

<h2>Optimal AI&trade; - 403 (ai103) - Forbidden: Access is denied.</h2><h3>You
tried to access a resource/page that you are not allowed to
access.</h3><h4>2024-03-02 15:47:24 utc / 89.64.94.9 /
xrz30o0wkdayadqrpxoff3tu<script>alert(1)</script>

Full HTTP requests and screenshots demonstrating the vulnerability have been
added to the evidence.docx file.

The OPTIMAL Cloud has an option to view different logs through the web UI.
Spiderlabs configured log access but was unable to access logs due to the fact
that the Splunk page, which displays the logs, was not reachable at the time of
testing. If the injected payload is displayed on the Splunk page unsanitized,
this vulnerability could escalate into a stored XSS. --------

Finding 3: Reflected Cross-Site Scripting (XSS)
*****Credit: Jean Calvin Mugabo of Trustwave
CWE: CWE-79

The Error.aspx page is vulnerable to reflected cross-site scripting (XSS). When
an XSS payload is provided within the HTTP request User Agent value, the
payload is reflected in the response unsanitized.

The below payload was submitted in the HTTP request User Agent.

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101
Firefox/115.0<script>confirm('user agent')</script>

The payload was reflected in the response.

<td>Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101
Firefox/115.0<script>confirm('user agent')</script></td>

Full HTTP requests and screenshots demonstrating the vulnerability have been
added to the evidence.docx file.

The OPTIMAL Cloud has an option to view different logs through the web UI.
Spiderlabs configured log access but was unable to access logs due to the fact
that the Splunk page, which displays the logs, was not reachable at the time of
testing. If the injected payload is displayed on the Splunk page unsanitized,
this vulnerability could escalate into a stored XSS. --------

Finding 4: Arbitrary Redirection *****Credit: Jean Calvin Mugabo of Trustwave
CWE: CWE-601

The "Forgot Password" feature uses a query parameter named `ReturnUrl`, which
is intended to hold a URL that redirects the user back to the main application
after resetting their password.

```
https://mail.theoptimalcloud.com/v5.0/webapps/pages/public/ForgotPwd.aspx?Return
 Url={URL} ```

The application fails to properly validate URLs passed through the `ReturnUrl`
parameter.

For demonstration, the URL `https://www.trustwave.com` was injected into the
`ReturnUrl` parameter:

```
https://mail.theoptimalcloud.com/v5.0/webapps/pages/public/ForgotPwd.aspx?Return
 Url=https%3A%2F%2Fwww.trustwave.com ```

The server response included below HTML code for a button designed to redirect
users back to the main application. However, the ReturnUrl value was directly
passed to the window.location.href function, leading to an arbitrary
redirection vulnerability.

```html <div id="divButtonbtnLogin" style="display: inline-block;white-space:
nowrap;"> <button id="btnLogin" name="btnLogin" type="button" class="btn
btn-secondary"
onclick="javascript:window.location.href=&#39;https://www.trustwave.com&#39;;"><
 span>Return to App</span></button> </div> ```

As a result, clicking on the "Return to App" button would redirect to
https://www.trustwave.com instead of the main URL of the application.

An attacker can exploit this to redirect a user to a malicious site. The user
may not realize that they have been sent to a different location, especially if
the domain name and page layout are similar.

Arbitrary Redirection vulnerabilities can facilitate a range of malicious
exploits, including phishing attacks, malware distribution, SEO spamming,
drive-by downloads, session hijacking, browser exploitation, social
engineering, and credential harvesting.

Full HTTP requests and screenshots demonstrating the vulnerability have been
added to the evidence.docx file.

-------

Vendor Response: Vendor unresponsive

Remediation Steps: Pending

Revision History:
03/06/24 - Initial email to vendor
03/20/24 - 2nd email to vendor
04/02/24 - Voicemail left for vendor HQ Contact
04/03/24 - Follow up voicemail for vendor HQ Contact
05/15/24 - No Response
06/15/24 - Moving forward with Full Disclosure
07/12/24 - Advisory published

About Trustwave: Trustwave is a globally recognized cybersecurity leader that
reduces cyber risk and fortifies organizations against disruptive and damaging
cyber threats. Trustwave's comprehensive offensive and defensive cybersecurity
portfolio detects what others cannot, responds with greater speed and
effectiveness, optimizes its client's cyber investment, and improves security
resilience. Trusted by thousands of organizations worldwide, Trustwave
leverages its world-class team of security consultants, threat hunters, and
researchers, and its market-leading security operations platform to decrease
the likelihood of attacks and minimize potential impact. Trustwave is an
analyst-recognized leader in managed detection and response (MDR), managed
security services (MSS), cyber advisory, penetration testing, database
security, and email security. The elite Trustwave SpiderLabs team provides
industry-defining threat research, intelligence, and threat hunting, all of
which are infused into Trustwave services and products to fortify cyber
resilience in the age of inevitable cyberattacks.

For more information about Trustwave, visit https://www.trustwave.com

About SpiderLabs: Trustwave SpiderLabs is among the most well-respected teams
in the cybersecurity industry, with a reputation for conducting cutting-edge
research, plying the foggy corners of the Dark Web for intelligence,
proactively protecting clients, and detecting and hunting down threats. With
more than 250 specialized experts across the globe, Trustwave SpiderLabs is a
world-class team of security consultants, threat hunters, incident responders,
forensic investigators, and researchers.

For more information about Trustwave SpiderLabs, visit
https://www.trustwave.com/spiderlabs

Disclaimer: The information provided in this advisory is provided "as is"
without warranty of any kind. Trustwave disclaims all warranties, either
express or implied, including the warranties of merchantability and fitness for
a particular purpose. In no event shall Trustwave or its suppliers be liable
for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if Trustwave
or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential
or incidental damages so the foregoing limitation may not apply.