XSS At `/forms/smpwservices.fcc` via `USERNAME` Parameter

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• CA Single Sign-On

Issue/Introduction

Description:

An exploitable vulnerability was reported in the Vulnerability Disclosure Program.

Steps to Reproduce

1- Visit the following URL in your browser: https://elogin.sandbox.com/forms/smpwservices.fcc?USERNAME=%514FQDNimg%5194FQDNrc%55dmxx%nerror%5dd3d%54ndcconfirm(document.domain)%&SMAUTHREASON=7
2- You should see an alert indicating a successful Cross-Site Scripting attack.

Environment

Release:
Component: SMIIS

Resolution

Solution:

To resolved this issue, we need to add \ to the BadCSSChars.