bugtraq - MVSA-10-001 - Google Message Security SaaS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: 15 Sep 2010 20:22:23 -0000
From: marian.ventuneac@...il.com
To: bugtraq@...urityfocus.com
Subject: MVSA-10-001 - Google Message Security SaaS - SQL Injection
 vulnerabilities

Security Advisory:	MVSA-10-001
Vendor: 		Google 	
Service: 		Google Message Security SaaS (powered by Postini) 
			        - Message Center II
Vulnerabilities: 	SQL Injection
Risk: 			High 	
Attack Vector: 		From Remote 	
Authentication:		Required
Reference:		http://www.ventuneac.net/security-advisories/MVSA-10-001
			http://secureappdev.blogspot.com/2010/09/testing-google-message-security-saas.html

Description

Message Center II service (build 6_24) was found vulnerable to SQL Injection attacks. When exploited by an attacker, the identified vulnerability could lead to Information Disclosure (map database structure, extract data from available tables), Denial of Service (consume server resources by injecting SQL heavy queries), etc.

An authenticated attacker without administrative privileges can inject arbitrary code into the SQL query built to generate the list of quarantined/deleted e-mails. This can be achieved by  manipulating  the sort_direction parameter of /junk_quarantine/process and /trash/process resources.

Test case: sort_direction='

POST https://mc-s200.postini.com/app/msgctr/junk_quarantine/process HTTP/1.1
Host: mc-s200.postini.com
...
Content-Type: multipart/form-data; boundary=---------------------------26418279386900
Content-Length: 1351
-----------------------------26418279386900
Content-Disposition: form-data; name="_submitted_junk_quarantine_form"
1
...
-----------------------------26418279386900
Content-Disposition: form-data; name="range_menu"
1-14
-----------------------------26418279386900
Content-Disposition: form-data; name="sort_menu"
from_asc
-----------------------------26418279386900
Content-Disposition: form-data; name="sort_direction"
desc'
-----------------------------26418279386900
...

Due to the unsafe inclusion of user provided content into the dynamically built SQ statement, the system returns an error  including details on the database engine used, error type, middleware settings, and SQL error stack trace. Such information allowed devising further SQL Injection test cases.

Affected Versions

Message Center II service of Google Message Security SaaS build 6_24 (January 2010).

Mitigation

Google fixed the issue in Message Center II build 6_25 (February 2010).

Disclosure Timeline

2010, January 29: Vulnerability discovered and documented
2010, January 30: First notification sent to Google
2010, February 1: Second notification sent to Google
2010, February 2: Third notification sent to Google
2010, February 3: Google acknowledges the vulnerability
2010, February 22: Fix deployed in production (build 6_25)
2010, September 15: MVSA-10-001 advisory published

Credits

Dr. Marian Ventuneac
http://ventuneac.net