OMSA 10.1 Vulernable to CGI Generic SQL Injection?

Question

Our Tenible Nessus scanner is saying that OMSA 10.1 is Vulnerable to

CGI Generic SQL
Injection (blind,
time based)

Severity HIGH

Using the GET HTTP method, Nessus found that :
+ The following resources may be vulnerable to blind SQL injection (time based) :
+ The 'searchQuery' parameter of the /help/omahip/en/search.html CGI :
/help/omahip/en/search.html?searchQuery='%20AND%20SLEEP(21)='
-------- output --------
------------------------

Synopsis: A CGI application hosted on the remote web server is potentially prone to SQL injection attack.
Description: By sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a slower
response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database.
An attacker may be able to exploit this issue to bypass authentication, read confidential data, modify the remote database, or even take control of the
remote operating system.
Note that this script is experimental and may be prone to false positives

Solution: Modify the affected CGI scripts so that they properly escape arguments.
See Also: http://www.securiteam.com/securityreviews/5DP0N1P76E.html
http://www.nessus.org/u?ed792cf5
http://projects.webappsec.org/w/page/13246963/SQL%20Injection
Risk Factor: High
CVSS V3 Base Score:

Dell-Martin S · Answer

Hi kevins,

thank you for your feedback i will forward this to our Software team.

Did you try also our newest Version( 10.2)?

https://dell.to/33pX2PL

Did you have any further questions?

Regards Martin

kevins7189-2 · Answer

struggling to find 10.2 in a Redhat version.

Origin3k · Answer

@Dell-Martin S

maybe you can also ask why a management application try to download external stuff and may leak sensitive information because of query to "https://fonts.googleapis.com/css?family=Noto+Sans+JP:300,400,500,700|Noto+Sans+KR:300,400,500,700|Noto+Sans+SC:300,400,500,700|Noto+Sans+TC:300,400,500,700|Noto+Sans:400,400i,700,700i|Roboto:300,300i,400,400i,500,500i,700,700i&display=swap&subset=chinese-simplified,chinese-traditional,japanese,korean"

@kevins7189-2

iam not sure how smart nessus is but we have a 20sec. delay because of access to google is not possible in our management network and this will slow down OMSA when using a normal browser.

Regards,
Joerg

DELL-Charles R · Answer

Hello laakins,   I am not finding anything related in our Security Advisories and Notices: https://dell.to/36gGNXa   I will do some checking and update you.

laakins · Answer

We are running 10.2 and get the same Nessus plugin output in addition to two additional CGI related findings. Any help would be greatly appreciated.

44967 - CGI Generic Command Execution (time-based)

Description

The remote web server hosts CGI scripts that fail to adequately sanitize request strings. By leveraging this issue, an attacker may be able to execute arbitrary commands on the remote host.

Note that this script uses a time-based detection method which is less reliable than the basic method.

See Also

http://www.securiteam.com/securityreviews/5DP0N1P76E.html

http://www.nessus.org/u?ed792cf5

http://projects.webappsec.org/w/page/13246963/SQL%20Injection

Solution

Modify the affected CGI scripts so that they properly escape arguments.

Using the GET HTTP method, Nessus found that :

+ The following resources may be vulnerable to blind SQL injection :

+ The 'app' parameter of the /HelpViewer CGI :

/HelpViewer?file=Redirect&app=oma'||'Redirect&app=oma

-------- output --------
HTTP/1.1 302
-------- vs --------
HTTP/1.1 400
------------------------

Clicking directly on these URLs should exhibit the issue :
(you will probably need to read the HTML source)

https://xxx.xxx.xxx.xxx:1311/HelpViewer?file=Redirect&app=oma'||'Redirect&app=oma

43160 - CGI Generic SQL Injection (blind, time based)

-

Description

By sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a slower response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database.

An attacker may be able to exploit this issue to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system.

Note that this script is experimental and may be prone to false positives.

Systems Management General

OMSA 10.1 Vulernable to CGI Generic SQL Injection?

Was this post helpful?