Summary

During a security assessment of Quest Policy Authority for Unified Communications version 8.1.2.200, I identified thirteen vulnerabilities across the Web Compliance Manager and Web Reporter components. The vulnerabilities range from pre-authentication reflected XSS and SSRF to post-authentication stored XSS and CSRF.

Quest confirmed the product has reached end-of-life and has been unsupported for over seven years at the time of disclosure. No patches will be issued.

Affected Product: Quest Policy Authority for Unified Communications Affected Version: 8.1.2.200 Vendor Status: End-of-life, no patch forthcoming

CVE-2020-35203 - Reflected XSS in Web Compliance Manager (Pre-Auth)

Component: Web Compliance Manager - initFile.jsp Parameter: msg Authentication: Not required CVSS: Medium

The initFile.jsp endpoint in the Web Compliance Manager accepts a msg parameter that is reflected in the response without sanitization.

GET /WebCM/initFile.jsp?msg=<script>alert(document.cookie)</script>

The injected script executes in the context of the application.

CVE-2020-35204 - Reflected XSS in FolderControl.jsp (Pre-Auth)

Component: Main application - FolderControl.jsp Parameter: unqID Authentication: Not required CVSS: Medium

The unqID parameter in FolderControl.jsp is reflected without encoding. This vulnerability has an additional impact: injecting certain payloads causes the application to return HTTP 500 errors, and the injected content persists in the user’s session.

CVE-2020-35205 - Server-Side Request Forgery in Web Compliance Manager (Pre-Auth)

Component: Web Compliance Manager - initFile.jsp Authentication: Not required CVSS: High

The initFile.jsp endpoint is vulnerable to SSRF. An unauthenticated attacker can force the server to make requests to arbitrary internal hosts and ports.

Impact:

  • Internal port scanning and service enumeration
  • On unconfigured instances: full application takeover by directing the initial configuration to an attacker-controlled database

This is the most critical finding in this advisory. The combination of pre-authentication access and SSRF enables an attacker to map internal infrastructure without any credentials.

CVE-2020-35206 - Reflected XSS in cConn.jsp (Pre-Auth)

Component: Web Compliance Manager - cConn.jsp Parameter: ur Authentication: Not required CVSS: Medium

The ur parameter in cConn.jsp is reflected in the page without proper encoding.

CVE-2020-35719 - Reflected XSS in Search (Post-Auth)

Component: Web Compliance Manager - index.jsp Parameter: added Authentication: Required CVSS: Medium

The search functionality in index.jsp reflects the added parameter without sanitization. Requires a valid session.

CVE-2020-35720 - Stored XSS in User Management (Post-Auth)

Component: Web Compliance Manager - submitUser.jsp Authentication: Required CVSS: High

User input submitted through submitUser.jsp is stored and rendered without sanitization. This enables persistent XSS that executes when any user views the affected page. Combined with the CSRF vulnerability (CVE-2020-35722), an attacker could inject stored XSS payloads without direct authentication.

CVE-2020-35721 - Reflected XSS in BrowseAssets.do (Post-Auth)

Component: Web Reporter - BrowseAssets.do Parameter: title Authentication: Required CVSS: Medium

The title parameter in the Web Reporter’s BrowseAssets.do endpoint is reflected without encoding.

CVE-2020-35722 - Cross-Site Request Forgery in User Management

Component: Web Compliance Manager - submitUser.jsp Authentication: Victim must be authenticated CVSS: High

The submitUser.jsp endpoint accepts user management actions (creating admin accounts, changing passwords) via GET requests with no CSRF token validation. An authenticated administrator visiting a malicious page will unknowingly execute these actions.

Impact: An attacker can create administrative accounts or change existing passwords by tricking an authenticated admin into visiting a crafted URL.

CVE-2020-35723 - Reflected XSS in ReportPreview.do (Post-Auth)

Component: Web Reporter - ReportPreview.do Parameter: referer Authentication: Required CVSS: Low

The referer parameter is reflected without encoding. Exploitation requires the victim to perform multiple actions, reducing practical impact.

CVE-2020-35724 - Reflected XSS in error.jsp (Post-Auth)

Component: Web Compliance Manager - error.jsp Parameter: err Authentication: Required CVSS: Medium

Error messages passed via the err parameter are rendered without sanitization.

CVE-2020-35725 - Reflected XSS in index.jsp Messages (Post-Auth)

Component: Web Compliance Manager - index.jsp Parameter: msg Authentication: Required CVSS: Medium

The msg parameter on the main index.jsp page is reflected without encoding.

CVE-2020-35726 - Reflected XSS in Reports (Post-Auth)

Component: Web Compliance Manager - index.jsp Reports section Parameter: by Authentication: Required CVSS: Medium

The by parameter used in the Reports section of index.jsp is reflected without encoding.

CVE-2020-35727 - Reflected XSS in BrowseDirs.do (Post-Auth)

Component: Web Reporter - BrowseDirs.do Parameter: by Authentication: Required CVSS: Medium

The by parameter in the Web Reporter’s BrowseDirs.do endpoint is reflected without sanitization.

Disclosure Timeline

Date Event
2020-12-09 Reported CVE-2020-35203, 35204, 35205, 35206 to Quest
2020-12-10 Quest requested additional information; provided same day
2020-12-11 Reported 5 additional vulnerabilities to Quest
2020-12-13 Notified Quest of remaining vulnerabilities
2020-12-16 Quest confirmed product is end-of-life; no patch will be issued
2020-12-16 Public disclosure

Recommendations

Organizations running Quest Policy Authority for Unified Communications should:

  1. Decommission the product immediately. The vendor has confirmed it is end-of-life with no security support.
  2. If immediate decommissioning is not possible, restrict network access to the Web Compliance Manager and Web Reporter interfaces to trusted management networks only.
  3. Monitor access logs for indicators of exploitation, particularly requests to initFile.jsp with unusual parameters.

References