TWSL2012-012: Cross-Site Scripting Vulnerability in Support Incident Tracker

Trustwave SpiderLabs has published a new advisory today for a reflective Cross-Site Scripting finding in the Support Incident Tracker (or SiT!). Currently, Support Incident Tracker version 3.65 and prior are affected. This finding is based on that the 'id' parameter in the 'index.php' is not sanitized and results in XSS. Jonathan Claudius who is a member of the SpiderLabs Research team discovered this vulnerability while implementing TrustKeeper probes for this product.

SpiderLabs has made multiple attempts to reach out to SiT! in mid March regarding this finding however the vendor has declined to comment. Bearing this in mind, users should beware that the latest version of SiT! (updated in September of 2011) has not addressed this issue. Administrators can mitigate this issue by defining rules within a web application firewall (WAF) solution and restricting access from outsiders. Administrators can also defend themselves against this particular finding by applying a patch developed by Jonathan Claudius of Trustwave SpiderLabs. The patch can be downloaded here.

Id_parameter_xss_patch

Additionally, Trustwave SpiderLabs has deployed protections for this finding in the ModSecurity Commercial Rules Feed and the TrustKeeper vulnerability scanning solution has been updated to detect this finding.

For more details regarding this advisory, please visit:

https://www.trustwave.com/spiderlabs/advisories/TWSL2012-012.txt

Trustwave reserves the right to review all comments in the discussion below. Please note that for security and other reasons, we may not approve comments containing links.