CVE-2011-0770

Vulnerability

The vulnerability resides in the Windows Event Log SmartConnector component of HP ArcSight Connector Appliance versions before 6.1. The SmartConnector fails to sanitize input fields when exporting reports. Specifically, an exported report for table parameters includes a drop-down selection field for "Microsoft OS Version". The "Windows XP" variable in the exported file is not sanitized, allowing injection of arbitrary web script or HTML. Affected versions include v6.0.0.60023.2 and possibly earlier releases [1].

Exploitation

An attacker with access to the ArcSight Connector Appliance can exploit this vulnerability by modifying the exported report file, which is world-writeable with a default name. The attacker injects JavaScript code into the "Windows XP" variable, for example: "Windows XP". When the file is imported back into the SmartConnector and the table parameters section is accessed for editing, the injected script executes [1].

Impact

Successful exploitation allows an attacker to conduct a cross-site scripting (XSS) attack, which could result in information leakage, privilege escalation, and/or denial of service. The attack runs in the context of the SmartConnector application [1].

Mitigation

HP released ArcSight Connector Appliance version 6.1 to address this vulnerability. Users should upgrade to version 6.1 or later. No workarounds are mentioned in the available reference [1].