bugtraq - CVE-2013-1402 - DigiLIBE Management Console - Execution After Redirect (EAR) Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 22 Jan 2013 08:58:53 -0600
From: i@...oot.com
To: bugtraq@...urityfocus.com
Subject: CVE-2013-1402 - DigiLIBE Management Console - Execution After Redirect
 (EAR) Vulnerability

Product: DigiLIBE Management Console
Vendor: Digitiliti
Version: < 3.4 - ?
Tested Version: 3.4
Vendor Notified Date: October 09, 2012
Release Date: January 18, 2013
Risk: High
Authentication: None required
Remote: Yes

Description:
Execution After Redirect vulnerabilities exist in DigiLIBE Management 
Console versions 3.4 and possibly other versions. This allows remote 
attackers to retrieve sensitive data that should only be returned to 
authenticated users.
By not properly terminating the code after redirection an 
unauthenticated attacker can choose to not follow the redirect and view 
the normally protected content.
Successful exploitation of this vulnerability resulted obtaining the 
contents of the 'General Configuration'.

Exploit steps for proof-of-concept:
1.    Using a proxy such as Burp Proxy intercept request: 
https://vulnerablehost.com/configuration/general_configuration.html
2.    Send to repeater.
3.    View response.

Vendor Notified: Yes
Vendor Response: November 11, 2012 - Deployed security update. Version 
not confirmed.

Reference:
CVE-2013-1402
http://cs.ucsb.edu/~bboe/public/pubs/fear-the-ear-ccs2011.pdf
https://www.owasp.org/index.php/Execution_After_Redirect_(EAR)

Credit:
Robert Gilbert
HALOCK Security Labs