CVE-2020-4702

Description

IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI, thus altering the intended functionality, potentially exposing credentials within a trusted session.

Proof-of-concept

Steps to reproduce:

1. Go to the module „Metadata Asset Manager” and log in as administrator,
2. Go to tab: „Administration” -> „Metadata Interchange Servers”,
3. Click on the „New” button,
4. In the field „Name” enter payload: <img src=x onerror=alert(document.domain)>,
5. In the field „Host” enter any string of characters,
6. Click on the „Save” button,
7. To make the injected JavaScript code execute:
   • Click on the „Delete” button,
   • Go to the „Import” tab,
   • Click on the „New Import” button and then expand the list next to the field „Metadata interchange server”.

Timeline

• 25-01-2020 - Vulnerability reported to the vendor
• 25-01-2020 - First response from the vendor
• 18-08-2020 - Vulnerability acknowledged by the vendor
• 03-09-2020 - Advisory published by IBM
• 03-09-2020 - Public disclosure
• 25-11-2021 - The PoC release

References

https://www.ibm.com/support/pages/node/6323721
IBM X-Force ID: 187187
https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-4702