full-disclosure - Applicure dotDefender 4.0 administrative interface cross site scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <AANLkTinzt7rtk0rdi3yvoUHCfrySeP3KSVNdmvCw40wC@mail.gmail.com>
Date: Tue, 1 Jun 2010 12:42:53 +0200
From: Sandro Gauci <publists@...blesecurity.com>
To: Full Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Applicure dotDefender 4.0 administrative
	interface cross site scripting

____________________________________________________________________________

Applicure dotDefender 4.0 administrative interface cross site scripting

____________________________________________________________________________

An advisory by EnableSecurity.

ID: ES-20100601

Advisory URL:
http://resources.enablesecurity.com/advisories/ES-20100601-dotdefender4.txt

Affected Versions: version 4.0

Fixed versions: 4.01-3 (and later)

Description:

Applicure dotDefender is a Web Application Firewall that can be installed on
Windows and Linux servers.

>>From their website (applicure.com):
"dotDefender is the market-leading software Web Application Firewall (WAF).
dotDefender boasts enterprise-class security, advanced integration capabilities,
easy maintenance and low total cost of ownership (TCO). dotDefender is the
perfect choice for protecting your website and web applications today. "

Credits:

These vulnerabilities were discovered during WAF testing by Sandro Gauci of
EnableSecurity. We contacted AppliCure on May 17, 2010 about this vulnerability.
They were already working on a fix.

____________________________________________________________________________

Technical details:

The log viewer facility in dotDefender does not properly htmlencode user
supplied input. This leads to a cross site scripting vulnerability when the log
viewer displays HTTP headers.

____________________________________________________________________________

Demo:

One may use curl and insert headers containing html tags using the --header
switch.
Example:

    curl "http://website.org/c?a=<script>" \
    --header "<script>alert(1)</script>: aa"

When the administrator views the log viewer page, his/her web browser will
execute the attacker's javascript.

The following demo shows how an attacker can switch off dotDefender in order to
bypass any "protection" offered by the WAF:

    http://vimeo.com/12132622

Timeline:

May 17, 2010: Initial contact
Jun 01, 2010: Release of this advisory

Solution:

Upgrade to the latest version of dotDefender:
http://www.applicure.com/

____________________________________________________________________________

Contact: "Sandro Gauci" <sandro@...blesecurity.com>

About EnableSecurity:

EnableSecurity is dedicated to providing high quality Information Security
Consultancy, Research and Development. EnableSecurity develops security tools
such as VOIPPACK (for Immunity CANVAS) and SIPVicious. EnableSecurity is
focused on analysis of security challenges and providing solutions to such
threats. EnableSecurity works on developing custom targeted security solutions,
as well as working with existing off the shelf security tools to provide the
best results for their customers. More info at enablesecurity.com

Disclaimer: The information in the advisory is believed to be accurate at the
time of publishing based on currently available information. Use of the
information constitutes acceptance for use in an AS IS condition. There are no
warranties with regard to this information. Neither the author nor the publisher
accepts any liability for any direct, indirect, or consequential loss or damage
arising from use of, or reliance on, this information.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/