The following XSS vulnerabilities have been identified in CA Identity Manager (CA IM) via a security audit.
These issues are seen in the CA NIM common component.
Releases : 14.0\ 14.1\ 14.2
Component : IdentityMinder(Identity Manager)
Cross-site scripting (stored)
Stored XSS attacks consist in the permanent injection of malicious payloads within the web application and takes effect when the victim's browser displays the corrupted page. When submitting the user creation, a POST request to the /iam/imnimsm/ui/UIRequestHandler endpoint is performed. The details of the user to create are inserted within a POST parameter called “xmlString” in XML formatting. A malicious payload can be placed within the “value” attribute of the username “property” tag. Since the payload is contained within an XML attribute it cannot contain “>” and “<” characters so in order to inject HTML tags the special characters have been encoded as HTML entities (e.g. > <) and subsequently URL encoded to avoid breaking the POST request parameter syntax (the & character introduces a new parameter in the request). In this way, it is possible to store an arbitrary script server-side.
Cross-site scripting (reflected)
The website does not sanitize the user input before it is placed in output in the web page.
Cross-site request forgery
Cross-Site Request Forgery (CSRF) is an attack that forces a legitimate user to perform unwanted actions on a web application in which they are currently authenticated.
Within the CA Identity Manager web application, the functionalities of add, edit and delete users within the CA Normalized Integration Management for Service Management section are vulnerable to Cross-Site Request Forgery attacks.
When performing one of these actions a POST request to the “/iam/imnimsm/ui/UIRequestHandler” endpoint is performed. The application is not able to verify that the request was performed directly by the legitimate user’s web page due to the lack of anti-CSRF mechanism.
The vulnerabilities are addressed in CA IM 14.3:
A specific Cross Site Vulnerability as described in this Redhat documentation: https://access.redhat.com/solutions/69379 was discovered in IDM deployments against JBOSS 7.2. This was resolved in 14.3 Cp3:
Please note that none of these vulnerabilities were actually encountered in production environments, they were identified via security audits. This is seen as CWE-79 on security reports.