bugtraq - Re: [WEB SECURITY] [CVE-2007-3816][Advisory] JWIG Context-Dependent Template Calling Dos

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 21 Jul 2007 19:49:19 +0530
From: Pranay Kanwar <warl0ck@...aeye.org>
To: Bubba Gump <bubbagump123@...il.com>
Cc: Aditya K Sood <zeroknock@...niche.org>,
	full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	websecurity@...appsec.org
Subject: Re: [WEB SECURITY] [CVE-2007-3816][Advisory] JWIG Context-Dependent
 Template Calling Dos

Hi,

Too bad you have fell for this without verifying things first i'll just break
two of the claims given by secniche.

First of all lets all get this straight, JWIG is for web services creation. For
the attacks to succeed the attacker will have to manipulate the things at the
server end.

Reading http://www.secniche.org/papers/HackAnnotationsInJWIG.pdf

1. Claim: Code gapping.

The example given will have to be written at the server end, very similar to writing
a PHP program. So tell me if you write rogue code yourself and load it is it JWIG to
blame ?. The attacker cannot load this rogue code. For example the code at the
following link

http://www.brics.dk/JWIG/demo/TempMan.jwig

Once this is compliled and installed, can't see how an attacker will manipulate this.

2. Claim: XML Fragmenting

This is where it gets really strange, the example given again has to written as a source
code, compiled and then installed. If i write a code that refers to a XML document
it is me responsible for ensuring that the things are right not JWIG, also this
is simply called External XML templates and it has nothing to do with fragmenting.

http://www.brics.dk/JWIG/manual/documents.html

So finally to put things together, Can't see where is the vulnerability.
If you write rogue code yourself you cannot blame JWIG, PHP etc.

The rest of the article is also filled with same bogus claims.

I would request everyone to take a very close look at secniche claims.

Also please continue using JWIG it is a sweet technology, especially features
like an explicit language-based notion of sessions, which avoids cookies and URL
rewriting, makes it a more better platform for writing secure web applications.

regards

warl0ck // MSG