Luca Carbone

Name of the Vulnerable Software and Affected Versions: Italtel S.p.A. i-MCS NFV version 12.1.0-20211215 Description: The issue is a cross-site scripting (XSS) vulnerability that allows unauthenticated remote attackers to inject arbitrary web script or HTML into HTTP/POST parameters. This can be exploited by attackers to execute malicious scripts on the victim's browser. Recommendations: For Italtel S.p.A. i-MCS NFV version 12.1.0-20211215, consider restricting access to HTTP/POST parameters to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using vulnerable parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An issue was discovered in the web application where the access token of an authenticated user is inserted inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded in other sources. If the query string contains sensitive information such as session identifiers, then attackers can use this information to launch further attacks. Because the access token is sent in GET requests, this could lead to complete account takeover.

An issue was discovered that allows stored Cross-site scripting (XSS) to occur via POST requests. This means an attacker can inject malicious scripts into the system, which can then be executed by other users, potentially leading to unauthorized actions or data theft.

An issue allows remote unauthenticated attackers to upload files at an arbitrary path.

An issue was discovered in the software, related to Incorrect Access Control.

The issue is related to improper input validation in the Web application, allowing authenticated users to execute commands on the Operating System.

An issue was discovered in the product where it does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter, which can be modified by an attacker to attribute every action they perform to a different user. This can be exploited without authentication.

A stored cross-site scripting (XSS) issue allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization.

An issue was discovered where the server does not properly handle application errors, leading to a disclosure of information about the server. An unauthenticated user can craft specific requests to make the application generate an error, revealing information such as the absolute path of the source code of the application. This information can help an attacker perform other attacks against the system. The issue can be exploited without authentication.

An issue was discovered where the web application inserts cleartext passwords in the HTML source code. An authenticated user can edit the configuration of the email server. When accessing the edit function, the web application fills the edit form with the current credentials for the email account, including the cleartext password.

An issue was discovered where the web server fails to sanitize input data, allowing remote unauthenticated attackers to read arbitrary files on the filesystem.

An issue was discovered in the web application where it does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

An OS Command Injection issue occurs in the `/cgi-bin/R19.9/log.pl` endpoint of the VM Manager WebUI via the `cmd` HTTP GET parameter. This allows authenticated users to execute commands with root privileges on the operating system.

The issue is related to a stack-based out-of-bounds write vulnerability that can be exploited by an authenticated remote attacker to write data into the stack. This can lead to a denial-of-service condition, memory overwriting, or remote code execution. The vulnerability is associated with a buffer overflow in memory, which can be exploited to cause a denial-of-service condition or execute arbitrary code.

The issue concerns incorrect Access Control. Specifically, it affects the "NMSCI-WebGui/advancedsettings.jsp" and "NMSCI-WebGui/SaveFileUploader" endpoints. This allows an attacker to view unauthorized pages and modify system configuration by bypassing controls without verifying user identity.

The issue allows an unauthenticated user to upload files to an arbitrary path due to Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An attacker can modify the `uploadDir` parameter in a POST request to an arbitrary directory. Since the application does not verify the upload directory, this can lead to unauthorized access to the server.

The issue allows for Multiple Reflected/Stored XSS, enabling an attacker to inject arbitrary JavaScript. This can be achieved via the "j security check" endpoint under NMSCIWebGui, using the `j username` parameter, or via the "actloglineview.jsp" endpoint under NMSCIWebGui, using the `name` or `actLine` parameters. The injected payload would be triggered every time an authenticated user browses the page containing it.

An issue exists in the software, allowing a remote authenticated attacker to read files on the filesystem arbitrarily due to an Absolute Path Traversal vulnerability. This vulnerability can be exploited via a specific endpoint using the `logfile` parameter.

A reflected XSS issue was discovered, affecting various "/oms1350/*" endpoints.

An issue exists in the software, where multiple Relative Path Traversal issues are present in different specific endpoints via the `file` parameter. This allows a remote authenticated attacker to read files on the filesystem arbitrarily.