Netsweeper Web Administration Reflected XSS Vulnerability (CVE-2015-20130) Advisory

The primary remediation is to apply the official security patches provided by Netsweeper. If immediate patching is not feasible, implement the following mitigations: 1. Deploy WAF Rules: Filter incoming requests to view_server_log.php that contain suspicious payloads in the log parameter. 2. Restrict Access: Limit access to the web administration interface to internal management networks or via VPN only.

apache # Example ModSecurity Rule SecRule REQUEST_URI "/webadmin/reporter/view_server_log.php" "chain,id:10001,phase:2,deny,status:403,msg:'Netsweeper XSS Attempt'" SecRule ARGS:log "@rx <script|javascript:|onerror="

The vulnerability exists in the webadmin/reporter/view_server_log.php endpoint of the Netsweeper administration interface. It is caused by the failure to sanitize or encode the log request parameter before reflecting it into the HTML response (CWE-79). An attacker can craft a malicious URL and trick an authenticated administrator into visiting it. Once executed, the script runs within the context of the administrator's session, allowing for unauthorized actions. Recent threat intelligence from the Shadowserver Foundation indicates that this vulnerability is being actively scanned and exploited in the wild as of late 2023.