I. VULNERABILITY
Stored/Persistent Cross-Site Scripting (XSS) - BSA Radar (Authenticated)
II. BACKGROUND
BSA Radar is a banking application provided by GLOBAL Radar which is implemented within corporate environments to perform SWIFT transactions, approve and review transactions, manage documents, manage users and roles and other features.
III. DESCRIPTION
The "Firstname" and "Lastname" parameters in Global RADAR BSA Radar 1.6.7234.X are vulnerable to a stored Cross-Site Scripting (XSS) via the Update User Profile feature (in the top-right of the application).
IV. History
The vulnerability was originally disclosed to the vendor on November 4, 2019.
The CVE was originally submitted on June 19, 2020.
CVE assigned: CVE-2020-14943
V. PROOF OF CONCEPT
Using the "update user profile" feature in the top-right of the application while logged in, a malicious user can inject malicious, unencoded scripts, such as "<script>alert(1)</script>", into the Firstname and Lastname parameters of a user account. This stored XSS will execute on nearly every application page as these parameters are always present while logged in. This attack can be further leveraged by utilizing an existing authorization bypass exploit (CVE-2020-14944) to inject stored XSS payloads into these parameters for arbitrary existing user accounts.
VI. BUSINESS IMPACT
Session hijacking, account takeover, disclosure of internal application data, credential theft via phishing.
VII. SYSTEMS AFFECTED
BSA Radar - Version 1.6.7234.24750 and lower
VIII. SOLUTION
Implement input validation and output encoding within the Firstname and Lastname input parameters to prevent malicious code and scripts from being injected into the application and stored. Sanitize HTML meta-characters such as "<" and ">" and other Javascript-related characters.
IX. REFERENCES
Mitre CVE-2020-14943
Exploit-DB CVE-2020-14943 - Persistent XSS
X. CREDITS
This vulnerability has been discovered and reported by William Summerhill
XI. DISCLOSURE TIMELINE
The vulnerability was originally disclosed to the vendor on November 4, 2019. The vulnerability was then patched and verified on April 26, 2020.