TWSL2012-012: Cross-Site Scripting Vulnerability in Support Incident Tracker

LevelBlue SpiderLabs has published a new advisory today for a reflective Cross-Site Scripting finding in the Support Incident Tracker (or SiT!). Currently, Support Incident Tracker version 3.65 and prior are affected. This finding is based on that the 'id' parameter in the 'index.php' is not sanitized and results in XSS. Jonathan Claudius who is a member of the SpiderLabs Research team discovered this vulnerability while implementing TrustKeeper probes for this product.

SpiderLabs has made multiple attempts to reach out to SiT! in mid March regarding this finding however the vendor has declined to comment. Bearing this in mind, users should beware that the latest version of SiT! (updated in September of 2011) has not addressed this issue. Administrators can mitigate this issue by defining rules within a web application firewall (WAF) solution and restricting access from outsiders. Administrators can also defend themselves against this particular finding by applying a patch developed by Jonathan Claudius of LevelBlue SpiderLabs. The patch can be downloaded here.

Additionally, LevelBlue SpiderLabs has deployed protections for this finding in the ModSecurity Commercial Rules Feed and the TrustKeeper vulnerability scanning solution has been updated to detect this finding.