F-Secure Radar is a turnkey vulnerability scanning and management platform. It allows you to identify and manage both
internal and external threats, report risks, and be compliant with current and future regulations (such as PCI and GDPR
compliance). It gives you visibility into shadow IT - to map your full attack surface and respond to critical
vulnerabilities associated with cyber threats.
F-Secure has remediated this issue; no action required for cloud users or on-premise users receiving updates.
The frontend application issues a PUT request to the server when metadata tags are updated:
PUT /api/latest/vulnerabilityscans/tags/batch HTTP/1.1 Host: portal.radar.f-secure.com [...]
[...], "Tags":["<img src=a onerror=\"alert(1)\">"], [...]
This script will execute whenever the frontend attempts to suggest tags, e.g. when a user opts to add tags to a new asset.
Vulnerability Disclosure Timeline
2018-01-24 - Vulnerability discovered
2018-01-24 - Vendor contact & response
2018-02-01 - Vendor confirms fix
2018-02-15 - Public disclosure