bugtraq - Netegrity SiteMinder smpwservicescgi.exe target specification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <5F9D803B30A8E4418166E637D50E9E2A139F3B@miraculix.scip.ch>
Date: Mon, 17 Jan 2005 17:42:55 +0100
From: "Marc Ruef" <maru@...p.ch>
To: <bugtraq@...urityfocus.com>, <full-disclosure@...ts.netsys.com>,
        <news@...uriteam.com>, <submissions@...ketstormsecurity.org>,
        <partners@...unia.com>, <red@...sec.de>
Subject: Netegrity SiteMinder smpwservicescgi.exe target
	specification

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear ladies and gentlemen

We have found a potential security vulnerability in the Netegrity SiteMinder script smpwservicescgi.exe. If a user is connecting to a secured web server over an url like https://www.scip.ch (just an example with our domain) he will get forwarded to the logon url https://www.scip.ch/siteminderagent/pwcgi/smpwservicescgi.exe?TYPE=32564432&REALMOID=02-0005b182-32f3-2121-ab24-8350cdfdaf3b&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$5rR6TLmkLOjh8Qac1FGeB5OHEA63VfWpQjt0OYda1BBrydPC0NKSWg%3d%3d&TARGET=$SM$https%3a%2f%2fwww%2escip%2ech%2fintern%2ehtml - In this url string several data is prepared to be processed as $QUERY_STRING in a common form http get request. As you can see, the last variant is named TARGET. This specifies the target url after authentication. In the example the url https://www.scip.ch/internal.html

The problem is, that a malicous user may use this to realize a social hacking or phishing attack. He may define a malicous web site as target to forward to another web site with unrelated content (e.g. porn), a cross site scripting or more severe vulnerability (e.g. JPEG exploit). The lack of reputation or launching another attack may be possible. It is also possible to shorten the malicous url to https://www.scip.ch/siteminderagent/pwcgi/smpwservicescgi.exe?TARGET=http%3a%2f%2fwww%2ecomputec%2ech - This is ideal to put it into a phishing mail. You find the original advisory, written in german, on http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1022 (Netegrity SiteMinder Login TARGET-Weiterleitung Designfehler).

We have not found any information on that issue. So I sent this information (nearly the same posting) on 14/12/04 to info-emea@...egrity.com and asked for a solution. As I haven't heard _anything_ until 23/12/04 I sent a reminder email. Due no reply came back we made this vulnerability public finally to force Netegrity to react on this case. An Attack Tool Kit (ATK) plugin that addresses this vulnerability will be published in the next days[1].

Regards,

Marc Ruef

[1] http://www.computec.ch/projekte/atk/

- -- 
) scip AG (
Technoparkstr. 1
8005 Zürich
T +41 1 445 18 18 
F +41 1 445 18 19

maru@...p.ch
www.scip.ch

- - Aktuellste IT-Sicherheitsluecken -

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
Comment: http://www.scip.ch

iQA/AwUBQevrDhe5hzJzqVMhEQLX8QCeNnfaNUTqAlkNqF49dV/jyTFwuBoAn3UG
KAjYMXWByPzqHfyzGxw7dlHw
=eo/G
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html