The supplied facility for importing host data from a file (System Admin Tab | Network | Hosts | Import from Local File) to the HP Arcsight Connector or HP Arcsight Logger appliances fail to sanitize input for cross-site scripting attacks. An attacker with write access to the file that will be imported can add javascript code into the file. This code will be run in the security context of the appliance administrative web GUI when the file is imported.

A remote attacker may, by luring a user into importing a malicious host file, be able to disclose sensitive information, steal user cookies, or escalate privileges.

We are currently unaware of a practical solution to this problem.

Do not import host file from untrusted sources

Attackers must deliver a malicious host file to, or modify an existing file on, a vulnerable system in order to take advantage of this vulnerability. By only accessing host files, which cannot be modified by unprivileged users, from known and trusted sources the chances of exploitation are reduced.