Palo Alto Expedition Migration tool is vulnerable to multiple XSS attacks.
The "Account Name" field when adding new users is vulnerable to a stored XSS attack.
To reproduce:
1. Login to expedition management interface using admin credentials. 2. Go to the SETTINGS tab on the top level
3. Click on USERS
4. Add new users -- > Click on ‘+’ sign on top right
5. Add below details:
- Account name: <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME> - First name
- Last name
- Select any time zone
- Select any role
- Type password
- Select Authentication Server - Save the details
The configuration input items in the LDAP Server settings are vulnerable to stored XSS attacks.
To reproduce:
1. Login to expedition management interface using admin credentials. 2. Go to the SETTINGS tab on the top level
3. Click on the SERVERS
4. Click on ‘+’ (Add new server) sign on top right from LDAP section
5. Add below details to ADD NEW LDAP SERVER:
- Select Active (Even if you don’t select it is fine)
- Name: <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
- Address: <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME> - Prefix: <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
- Suffix: <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
- Port: 389
- Search Dn:
- Crypto: None
6. Save the details.
The configuration input items in the RADIUS Server settings are vulnerable to stored XSS attacks.
To reproduce:
1. Login to expedition management interface using admin credentials. 2. Go to the SETTINGS tab on the top level
3. Click on the SERVERS
4. Click on ‘+’ (Add new server) sign on top right from RADIUS section 5. Add below details to ADD NEW LDAP SERVER:
- Select Active (Even if you don’t select it is fine)
- Name: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
- Address: <IFRAME SRC="javascript:alert('XSS');"></IFRAME> - Port: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
- Shared Key: None
6. Save the details.
A reflected XSS vulnerability exists in the RADIUS Server settings page.
To reproduce:
1. Login to expedition management interface. 2. Go to the SETTINGS tab on the top level
3. Click on the SERVERS
4. Click on ‘+’ (Add new server) sign on top right from RADIUS section 5. Add below details to ADD NEW LDAP SERVER:
- Select Active (Even if you don’t select it is fine)
- Name: <IFRAME SRC="javascript:alert('alpha');"></IFRAME> - Address: <IFRAME SRC="javascript:alert('beta');"></IFRAME> - Port: <IFRAME SRC="javascript:alert('gamma');"></IFRAME> - Shared Key: <any>
6. Save the details.