Reflected XSS in Network Optix Nx Witness VMS

Executive Summary

This is a cross-site scripting (XSS) vulnerability in the Web Administration interface of Network Optix Nx Witness VMS versions before 6.1.3. An attacker on the same network can exploit it by setting a malicious script in a server's site name. When an administrator opens the 'Merge with Another Site' dialog, the script executes in their browser, stealing their session token and allowing full administrative account takeover.

Useful 0 Not Useful 0

Detection Guidance

Check if your Network Optix Nx Witness VMS version is below 6.1.3. Inspect network traffic for rogue servers with malicious script payloads in their system names. Monitor WebAdmin interface logs for unexpected script execution during 'Merge with Another Site' dialog interactions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full administrative access to your Network Optix Nx Witness VMS without needing credentials. This could allow them to view, modify, or delete sensitive video feeds, user accounts, and system configurations. The attack requires the attacker to be on the same network segment as your system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating privacy regulations like GDPR and HIPAA. Unauthorized administrative access may result in data breaches, non-compliance with data protection requirements, and potential legal consequences for organizations handling protected information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Network Optix Nx Witness VMS to version 6.1.3 or later. Ensure no rogue servers with malicious system names are present on the network. Verify that HTML entity encoding is applied to external server metadata in the WebAdmin interface.

Useful 0 Not Useful 0