Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help due to improper sanitization of user-supplied input to unspecified parameters or to messages used in topic links. A remote attacker can exploit these to inject arbitrary script code or HTML into the user's browser session.

a. WebWorks Help - Cross-site scripting vulnerability

   WebWorks Help is an output format that allows online Help to be    delivered on multiple platforms and browsers, which makes it easy    to publish information on the Web or on an enterprise intranet.
   WebWorks Help is used for creating the online help pages that are    available in VMware WebAccess, Lab Manager and Stage Manager.

   WebWorks Help doesn't sufficiently sanitize incoming requests which    may result in cross-site scripting vulnerabilities in applications    that are built with WebWorks Help.

   Exploitation of these vulnerabilities in VMware products requires    tricking a user to click on a malicious link or to open a malicious    web page while they are logged in into vCenter, ESX or VMware    Server using WebAccess, or logged in into Stage Manager or Lab    Manager.

   Successful exploitation can lead to theft of user credentials. These    vulnerabilities can be exploited remotely only if the attacker has    access to the Service Console network.

   Security best practices provided by VMware recommend that the    Service Console be isolated from the VM network. Please see    http://www.vmware.com/resources/techresources/726 for more    information on VMware security best practices.

   Client-side protection measures included with current browsers are not    always able to prevent these attacks from being executed.

   VMware would like to thank Daniel Grzelak and Alex Kouzemtchenko of    stratsec (www.stratsec.net) for finding and reporting this issue.
   VMware would also like to thank Ben Allums of WebWorks.com for working    on the remediation of this issue with us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the name CVE-2009-3731 to this issue.

ID	Name	Product	Family	Severity
89118	VMware ESX WebWorks Help Multiple XSS (VMSA-2009-0017) (remote check)	Nessus	Misc.	medium
52012	VMSA-2009-0017 : VMware vCenter, ESX patch and vCenter Lab Manager releases address XSS issues	Nessus	VMware ESX Local Security Checks	medium

Detections

Analytics

CVE-2009-3731

medium

Tenable Plugins

medium

medium