Barracuda Networks Message Archiver product is vulnerable to persistent and reflected Cross-Site Scripting (XSS) attacks.
Barracuda Spam Firewall, IM Firewall and Web Filter products are vulnerable to multiple reflected XSS attacks.
When exploited by an authenticated user, the identified vulnerabilities can lead to Information Disclosure, Session Hijack,
access to Intranet available servers, etc.
Description
The index.cgi resource was identified as being susceptible to multiple persistent and reflected Cross Site Scripting (XSS)
attacks.
Persistent XSS in Barracuda Message Archiver
In Search Based Retention
Policy, the Policy Name field allows persistent XSS when set to something
like
policy_name" onblur="alert('xss')
Reflected XSS in Barracuda Message Archiver
Setting various parameters in IP Configuration, Administration, Journal Accounts, Retention Policy, and GroupWise Sync allow
reflected XSS attacks.
Reflected XSS in Barracuda Spam Firewall, IM Firewall and Web Filter
User provided input is not sanitised when displayed as part of error
messages - identified in all verified products.
User provided input is not sanitised when used to perform various
searches - identified in Barracuda Web Filter.
Manipulation of HTML INPUT hidden elements - identified in all verified
products, e.g auth_type INPUT hidden element allows a reflected XSS attack
when set to something like Local"><script>alert('xss')</script>
Barracuda Message Archiver (Firmware v1.1.0.010, Model 350)
Barracuda Spam Firewall (Firmware v3.5.11.020, Model 600)
Barracuda Web Filter (Firmware v3.3.0.038, Model 910)
Barracuda IM Firewall (Firmware v3.0.01.008, Model 420)
Other models/firmware versions might be affected.
Mitigation
Vendor recommends upgrading to the following firmware version:
Alternatively, please contact Barracuda Networks for technical support.
Credits
Dr. Marian Ventuneac,
Data Communications Security Laboratory,
Department of Electronic & Computer Engineering,
University of Limerick
Disclaimer
Data Communications Security Laboratory releases this information with the vendor acceptance. DCSL is not responsible for any
malicious application of the information presented in this advisory.