CVE-2012-2662

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the Red Hat Certificate System (RHCS) and Dogtag Certificate System before version 8.1.1. The flaw resides in the System Agent and End Entity web interface pages, where unspecified parameters are not properly sanitized, allowing injection of arbitrary web script or HTML. This affects the pki-core packages in Red Hat Enterprise Linux 6, as noted in the advisory [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL or form input that, when processed by the affected Agent or End Entity pages, injects and executes arbitrary script or HTML [2]. The attacker requires no special privileges; the attack is performed by luring a victim with a valid session to interact with the crafted input. The flaw is exploitable over the network without authentication, typical of XSS attacks.

Impact

Successful exploitation enables the attacker to perform a cross-site scripting attack against users of the Certificate System's web interface [1]. This can lead to session theft, credential harvesting, defacement, or other client-side attacks within the context of the victim's browser session with the Certificate System. The impact is considered Moderate by Red Hat [2].

Mitigation

Red Hat released updated pki-core packages as part of RHSA-2015:1347 to fix this issue for Red Hat Enterprise Linux 6 [1]. Additionally, the earlier RHSA-2012:1103 addressed the flaw for Red Hat Certificate System 8.1 [2]. Users should upgrade to the fixed versions (RHCS 8.1.1 or later) and restart all Certificate System subsystems. No workarounds were provided; applying the updates is the recommended mitigation.