PHOENIX CONTACT: XSS and memory-leak in FL MGUARD 1102/1105
Cross-site scripting in web-based management and memory leak in the remote logging function of FL MGUARD 1102 and FL MGUARD 1105. CVE-2021-34582: The file upload functionality in the web-based management is affected by a stored cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation). An authenticated FL MGUARD user with Admin or Super Admin role can upload a certificate file on the Basic settings > LDAP page, on the Logs > Remote logging page, or through the REST API. The content of this file is embedded into the corresponding web page, and any HTML code within the file is rendered when the page is viewed by the same or a different authenticated user. CVE-2021-34598: The remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote logging is active (CWE-770: Allocation of Resources Without Limits or Throttling).
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-34598US | medium4.3 | — | ||
In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for data structures from sy… | ||||
| CVE-2021-34582US | medium4.8 | — | ||
In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through web-based management or the REST API wi… | ||||
references
External citations — patches, advisories, analysis.
remediations (4)
- Mitigation
CVE-2021-34582: If an untrusted user may have exploited the vulnerability, it is recommended to revoke access for that user, and to re-upload the certificates on the Basic settings > LDAP and Logs > Remote logging pages through the REST API (i.e., without viewing these pages in the web-based management). CVE-2021-34598: To prevent the possibility of an attack, it is recommended to deactivate remote logging.
- Mitigation
CVE-2021-34582: If an untrusted user may have exploited the vulnerability, it is recommended to revoke access for that user, and to re-upload the certificates on the Basic settings > LDAP and Logs > Remote logging pages through the REST API (i.e., without viewing these pages in the web-based management). CVE-2021-34598: To prevent the possibility of an attack, it is recommended to deactivate remote logging.
- Fixed
PHOENIX CONTACT recomments to upgrade to firmware version 1.5.1 (or any later version) which fixes both vulnerabitlities. If the Basic settings > LDAP or Logs > Remote logging page are viewed after the upgrade, an exploit that may have been embedded into these pages is no longer effective. It is recommended to review all settings for modifications that an untrusted user may have made by exploiting this vulnerability before the upgrade. It is recommended to mistrust logs (generated before the upgrade) with respect to which user modified any settings.
- Fixed
PHOENIX CONTACT recomments to upgrade to firmware version 1.5.1 (or any later version) which fixes both vulnerabitlities. If the Basic settings > LDAP or Logs > Remote logging page are viewed after the upgrade, an exploit that may have been embedded into these pages is no longer effective. It is recommended to review all settings for modifications that an untrusted user may have made by exploiting this vulnerability before the upgrade. It is recommended to mistrust logs (generated before the upgrade) with respect to which user modified any settings.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan