Permanent XSS:

Advisory Name: Permanent Cross-Site Scripting (XSS) in Hipergate 4.0.12

Vulnerability Class: Permanent Cross-Site Scripting (XSS)

Release Date: 2010-02-02

Affected Applications: Confirmed in Hipergate 4.0.12. Other versions may also be affected

Affected Platforms: Multiple

Local / Remote: Remote

Severity: Medium – CVSS: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Researcher: Nahuel Grisolía

Vendor Status: Still Vulnerable – No Patch Available at the moment

Vulnerability Description:
A permanent Cross Site Scripting vulnerability was found in Hipergate 4.0.12, because the application
fails to sanitize user-supplied input. Any logged-in user who is able to add a New Campaign can trigger
the vulnerability.

Proof of Concept:
* Add <script>alert(“XSS in Campaign”);</script> as a new campaign.

Impact:

An affected user may unintentionally execute scripts or actions written by an attacker. In addition, an
attacker may obtain authorization cookies that would allow him to gain unauthorized access to the
application.
Solution: Maybe in Build 5.5 (Future Release, information provided by the vendor)
Vendor Response: Last Contact on January 12, 2010. They said that no more patches would be
provided since Build 5.5 will be released soon.
Contact Information:
For more information regarding the vulnerability feel free to contact the researcher at
nahuel.grisolia <at> gmail <dot> com

Reflected XSS:

Advisory Name: Reflected Cross-Site Scripting (XSS) in Hipergate

Vulnerability Class: Reflected Cross-Site Scripting (XSS)

Release Date: 2010-02-02

Affected Applications: Confirmed in Hipergate 4.0.12. Other versions may also be affected

Affected Platforms: Multiple

Local / Remote: Remote

Severity: Medium – CVSS: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Researcher: Nahuel Grisolía

Vendor Status: Still Vulnerable – No Patch Available at the moment

Vulnerability Description:

A reflected Cross Site Scripting vulnerability was found in Hipergate 4.0.12, because the application
fails to sanitize user-supplied input. Any logged-in user can trigger the vulnerability.

Proof of Concept:

http://x.x.x.x:8080/hipergate/common/errmsg.jsp?title=%3Cscript%3Ealert%28%22titleXSS%22%29;
%3C/script%3E&desc=%3Cscript%3Ealert%28%22descXSS%22%29;%3C/script%3E&resume=_bac
k
Script pwd_errmsg.jsp is also affected.

Impact:

An affected user may unintentionally execute scripts or actions written by an attacker. In addition, an
attacker may obtain authorization cookies that would allow him to gain unauthorized access to the
application.
Solution: Maybe in Build 5.5 (Future Release, information provided by the vendor)
Vendor Response: Last Contact on January 12, 2010. They said that no more patches would be
provided since Build 5.5 will be released soon.
Contact Information:
For more information regarding the vulnerability feel free to contact the researcher at
nahuel.grisolia <at> gmail <dot> com

SQL Command Exec:

Advisory Name: SQL Command Exec in Hipergate

Vulnerability Class: SQL Command Exec

Release Date: 2010-02-02

Affected Applications: Confirmed in Hipergate 4.0.12. Other versions may also be affected.

Affected Platforms: Multiple

Local / Remote: Remote

Severity: High – CVSS: 10 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

Researcher: Nahuel Grisolía

Vendor Status: Still Vulnerable – No Patch Available at the moment

Vulnerability Description:
A vulnerability has been discovered in Hipergate, which can be exploited by malicious people to
conduct SQL Command Execution Attacks.
The vulnerability is confirmed in version 4.0.12. Other versions may also be affected.

Proof of Concept:

http://x.x.x.x:8080/hipergate/admin/sql.htm

Impact: Execute arbitrary SQL queries.

Solution: Maybe in Build 5.5 (Future Release, information provided by the vendor)

Vendor Response: Last Contact on January 12, 2010. They said that no more patches would be
provided since Build 5.5 will be released soon.

Contact Information:

For more information regarding the vulnerability feel free to contact the researcher at
nahuel.grisolia <at> gmail <dot> com