Arista NG Firewall Cross-Site Scripting Vulnerability Leaking Administrator Tokens

A cross-site scripting vulnerability has been identified in Arista Edge Threat Management - Arista NG Firewall, specifically in versions through 17.1.1. This vulnerability allows specially crafted queries to leak administrator authentication tokens. The issue arises from improper handling of query data, which can be exploited to access sensitive token information.

Impact

Exploitation of this vulnerability leads to the unauthorized disclosure of administrator authentication tokens, which could be used to impersonate an administrator.

Reproduction

To reproduce this vulnerability, an administrator can log into the Arista NG Firewall user interface and navigate to the Reports section. From there, under Administration, click 'All Settings Changes' to view the logs. The vulnerability can be exploited by sending specially constructed queries that will appear as changes from an unrecognized hostname or IP address, indicating a leak of administrator tokens.

Remediation

Users are advised to upgrade to Arista NG Firewall version 17.2.