Fuzz Testing for Code Injection Vulnerabilities in Network Management Systems

To handle the complexity of modern technical systems, the operator often relies on some kind of graphical user interface software. Such software typically provides statistics, visualization and remote management capabilities to the operator. Today, this software is usually implemented using various web technologies. This lets operators monitor and manage the system in question with a tool familiar to most people today, namely their web browser. Unfortunately, web technology comes with plenty of intricate and unexpected caveats and flaws that can lead to unpredictable and sometimes even insecure behavior. In this paper, we focus on how one such obscure flaw, cross-channel scripting, can affect communications and service-provider networks. We provide a testing framework for detecting such flaws and use it to test four different open-source network management systems. Three vulnerabilities were found and acknowledged and fixed by the developers and one CVE was assigned.