Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. Script injection of certain symbols bypass portal UI restrictions in Update Rollup 13 for Windows Azure Pack

Script injection of certain symbols bypass portal UI restrictions in Update Rollup 13 for Windows Azure Pack

View products that this article applies to.

Symptoms

A security vulnerability exists in Update Rollup 13 for Windows Azure Pack (WAP) that causes script injection of certain symbols to bypass portal UI restrictions. The portal UI restricts certain symbols such as greater than ( < ) and less than ( > ) symbols that are needed for “<script>” injection.

By replaying a request in Fiddler, strings that contain characters such as < and > can be sent as the subscription name. The SubscriptionName field can be set to any string up to 128 characters. In this scenario, you can load and run various scripts such as <script src="https://code.jquery.com/jquery-1.10.2.min.js"> or <script>alert(document.cookie)</script>.

To learn more about this vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2018-8652.

↑ Back to the top

Resolution

Download information

Update packages for Windows Azure Pack are available from Microsoft Update or by manual download.

Microsoft Update

This security update is available through Windows Update. When you turn on automatic updating, this security update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.

Manual download of the update package

Go to the following website to manually download the security update package from the Microsoft Update Catalog:

Download the Windows Azure Pack security update package now.

↑ Back to the top

Installation information

Installation instructions

These installation instructions are for the following Windows Azure Pack components:

  • Tenant site
  • Tenant API
  • Tenant Public API
  • Administration site
  • Administration API
  • Authentication
  • Windows Authentication
  • Usage
  • Monitoring
  • Microsoft SQL
  • MySQL
  • Web Application Gallery
  • Configuration site
  • Best Practices Analyzer
  • PowerShell API
To install the update .msi files for each Windows Azure Pack component, follow these steps:
 
  1. If the system is currently operational (handling customer traffic), schedule downtime for the Azure servers. The Windows Azure Pack doesn't currently support rolling upgrades.
  2. Stop or redirect customer traffic to alternative sites that you consider satisfactory.
  3. Create backups of the computers.

    Notes
     
    • If you're using virtual machines, take snapshots of their current state.
    • If you're not using virtual machines, back up each MgmtSvc-* folder in the Inetpub directory on each computer that has a WAP component installed.
    • Collect information and files that are related to your certificates, host headers, and any port changes.
  4. If you're using your own theme for the Windows Azure Pack Tenant site, see How to Persist a Windows Azure Pack Theme after Microsoft Upgrade before you run the update.
  5. Install the update by running each .msi file on the computer on which the corresponding component is running. For example, run MgmtSvc-AdminAPI.msi on the computer that is running the "MgmtSvc-AdminAPI" site in IIS.
  6. For each node that is under load balancing, run the updates for components in the following order:
     
    1. If you're using the original self-signed certificates that were installed by WAP, the update operation will replace them. You have to export the new certificate and import it to the other nodes that are under load balancing. These certificates have a CN=MgmtSvc-* (self-signed) naming pattern.
    2. Update Resource Provider (RP) services (SQL Server, My SQL, SPF/VMM, websites) as necessary. And make sure that the RP sites are running.
    3. Update the Tenant API site, Public Tenant API, Administrator API nodes, and Administrator and Tenant Authentication sites.
    4. Update the Administrator and Tenant sites.
    The scripts to obtain database versions and update databases that are installed by the MgmtSvc-PowerShellAPI.msi are stored in the following location:
    C:\Program Files\Management Service\MgmtSvc-PowerShellAPI\Samples\Database

    If all components are updated and functioning as expected, you can open the traffic to your updated nodes. Otherwise, see the "Rollback instructions" section.

    Note If you're updating from an update rollup that is the same as or earlier than Update Rollup 5 for Windows Azure Pack, follow these instructions to update the WAP database.

↑ Back to the top

Keywords: kbsecurity, atdownload, kbbug, kbexpertiseinter, kbfix, kblangall, kbmustloc

↑ Back to the top

Article Info
Article ID : 4480788
Revision : 10
Created on : 12/11/2018
Published on : 12/11/2018
Exists online : False
Views : 71