bugtraq - Two Vulnerabilities in OpenWFE Web Client

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20041024200028.16695.qmail@www.securityfocus.com>
Date: 24 Oct 2004 20:00:28 -0000
From: Joxean Koret <joxeankoret@...oo.es>
To: bugtraq@...urityfocus.com
Subject: Two Vulnerabilities in OpenWFE Web Client

--------------------------------------------------------------------------- 
              Two Vulnerabilities in OpenWFE 
--------------------------------------------------------------------------- 

Author: Jose Antonio Coret (Joxean Koret) 
Date: 2004  
Location: Basque Country 

--------------------------------------------------------------------------- 

Affected software description: 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 

OpenWFE - Open WorkFlow Engine v1.4.x 

OpenWFE is an open source java workflow engine. 
It is a complete Business  
Process Management suite, with 4 components : 
an engine, a worklist, a  
webclient and a reactor (host for automatic 
agents). It can also be used  
behind the scene. 

Web : http://www.openwfe.org 

--------------------------------------------------------------------------- 

Vulnerabilities: 
~~~~~~~~~~~~~~~~ 

A. Cross Site Scripting Vulnerability in the 'Login 
Form' of the Web Client. 

A1. In the login form of the Web Client you has 3 
fields :  

	1.- The URL of the RMI Remote Service 
	2.- The username 
	3.- The Password 

Well, the URL field is vulnerable to an XSS attack 
due to no input validation.  
To test the problem follow these steps :  

	1.- Go to any site that have the OpenWFE 
webclient 
	2.- In the Worklist URL field insert, in example, 
the following data :  

rmi://localhost:7080/workSessionServer">&lt;script&gt;alert(document.cookie)&lt;/script&gt; 

	or this 

	rmi://<h1>hi</h1>:7099/workSessionServer 

	3.- Enter any username and password, and 
press the button to login. 

B. Possible Port Scanner 

B1. The field worklist URL is like this -> 

	rmi://<hostname>:<port>/location 

Due to the Worklist URL parameter's nature is 
possible to create a simple port/host  
scanner from the perspective of the OpenWFE 
host. 

Example :  

	Query -> rmi://server/workSessionServer 
	Response Time -> 1 second 
	Response -> Error : 
java.rmi.UnknownHostException: Unknown host 

	Query -> 
rmi://localhost:709/workSessionServer 
	Response Time -> 1 second 
	Response -> Error : 
java.rmi.ConnectException: Connection refused to 
	host 

	Query -> 
rmi://localhost:7085/workSessionServer 
	Response Time -> 5 seconds 
	Response -> Error : 
java.rmi.ConnectIOException: error during JRMP 
	connection establishment 

	Query -> 
rmi://drill.hackerslab.org:23/workSessionServer 
	Response Time -> Greater that 5 seconds 
	Response ->   
	Error : java.rmi.ConnectIOException: non-JRMP 
server at remote endpoint 

	Query -> rmi://192.168.1.2/workSessionServer 
	Response Time -> Greater than 30 seconds 
	Response -> No response, no timeout 

Depending on the Response Time and the 
Response is quite easy to create a simple  
port/host scanner. 

The fix: 
~~~~~~~~ 

The problems has been fixed in the latest release 
of the OpenWFE's web client. 
Go to http://www.openwfe.org for more information 
about the patch. 

Disclaimer: 
~~~~~~~~~~~ 

The information in this advisory and any of its 
demonstrations is provided 
"as is" without any warranty of any kind. 

I am not liable for any direct or indirect damages 
caused as a result of 
using the information or demonstrations provided 
in any part of this 
advisory.  

--------------------------------------------------------------------------- 

Contact: 
~~~~~~~~ 

 Joxean Koret at 
joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es